CVE-2019-13233: Use After Free
A vulnerability was found in arch/x86/lib/insn-eval.c in the Linux kernel, there is a use-after-free for access to an LDT entry because of a race condition between modifyldt() and a #BR exception for an MPX bounds violation.
Reference: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.9 https://bugs.chromium.org/p/project-zero/issues/detail?id=1879
Upstream commit: https://github.com/torvalds/linux/commit/de9f869616dd95e95c00bdd6b0fcd3421e8a4323 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=de9f869616dd95e95c00bdd6b0fcd3421e8a4323
Other sources
A vulnerability was found in the arch/x86/lib/insn-eval.c function in the Linux kernel. An attacker could corrupt the memory due to a flaw in use-after-free access to an LDT entry caused by a race condition between modifyldt() and a #BR exception for an MPX bounds violation.
In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modifyldt() and a #BR exception for an MPX bounds violation.
Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw when a race between modifyldt() and #BR Exception occurs. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-13233?
CVE-2019-13233 has a severity rating of medium due to its potential for causing a use-after-free condition.
How do I fix CVE-2019-13233?
To fix CVE-2019-13233, update to the recommended kernel versions provided by your distribution, such as kernel-rt and kernel packages from Red Hat.
Which versions of the Linux kernel are affected by CVE-2019-13233?
CVE-2019-13233 affects Linux kernel versions prior to 5.1.9.
Is CVE-2019-13233 specific to Red Hat or does it affect other distributions?
While CVE-2019-13233 is prominently noted in Red Hat environments, other Linux distributions that use affected kernel versions could also be vulnerable.
What type of vulnerability is CVE-2019-13233?
CVE-2019-13233 is a use-after-free vulnerability caused by a race condition in the Linux kernel.