CVE-2019-11487: Use After Free
A flaw was found in the Linux kernel's implementation of the FUSE filesystem, where it allows a page reference counter overflow. If a page reference counter overflows into a negative value, it can be placed back into the "free" list for reuse by other applications. This flaw allows a local attacker who can manipulate memory page reference counters to cause memory corruption and possible privilege escalation by triggering a use-after-free condition. The current attack requires the system to have approximately 140 GB of RAM for this attack to be performed. It may be possible that the attack can occur with fewer memory requirements.
Other sources
A flaw was found in the linux kernel's implementation of the FUSE filesystem, which allows for a page reference counter overflow. If a page reference counter overflows into a negative value it can be put back into the "free" list for re-use by other applications.
A local attacker who is able to manipulate memory page reference counters can abuse this situation to allow for memory corruption and possibly privilege escalation by triggering a Use After Free condition.
The current attack requires the system to have approximately 140 GiB of RAM for this attack to be carried out. It may be possible that the attack can be carried out with lesser memory requirements.
Reporter information: https://bugs.chromium.org/p/project-zero/issues/detail?id=1752
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6b3a707736301c2128ca85ce85fb13f60b5e350a
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a page->refcount overflow. A local attacker could exploit this vulnerability using FUSE with ~140GiB RAM usage to cause a denial of service.
— IBM
The Linux kernel before 5.1-rc5 allows page->refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipefsi.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-11487?
CVE-2019-11487 is classified as a high severity vulnerability due to the potential for local attackers to exploit it.
How do I fix CVE-2019-11487?
To mitigate CVE-2019-11487, upgrade to the fixed kernel versions specified by your Linux distribution.
What systems are affected by CVE-2019-11487?
CVE-2019-11487 affects various Linux kernel versions including those used in Red Hat, Ubuntu, and Debian operating systems.
Can CVE-2019-11487 be exploited remotely?
No, CVE-2019-11487 requires local access to the system to be exploited.
Is there a patch available for CVE-2019-11487?
Yes, multiple patches are available in the updated kernel versions from affected distributions.