CVE-2019-18874: Double Free
A double free issue has been discovered in python-psutil because of the mishandling of refcounts while converting system data into Python objects in functions like psutildiskpartitions(), psutilusers(), psutilnetifaddrs(), and others. In particular cases, a local attacker may be able to get code execution by manipulating system resources that python-psutil then tries to convert.
Other sources
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-18874?
CVE-2019-18874 has been classified as a medium severity vulnerability.
How do I fix CVE-2019-18874?
To fix CVE-2019-18874, upgrade to python-psutil version 5.6.6 or newer as specified by the vendor.
What software is affected by CVE-2019-18874?
CVE-2019-18874 affects the python-psutil package across several versions including 5.4.3-11.el8 and earlier.
What type of vulnerability is CVE-2019-18874?
CVE-2019-18874 is a double free vulnerability due to mishandling of reference counts.
Who can exploit CVE-2019-18874?
CVE-2019-18874 can potentially be exploited by local attackers.