CVE Vulnerabilities

CVE-2019-11811

Use After Free

Published: May 07, 2019 | Modified: Aug 11, 2023
CVSS 3.x
7
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
6.9 MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
7 MODERATE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Ubuntu
LOW

An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c.

Weakness

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Affected Software

Name Vendor Start Version End Version
Linux_kernel Linux 4.18 (including) 4.19.31 (excluding)
Linux_kernel Linux 4.20 (including) 5.0.4 (excluding)
Red Hat Enterprise Linux 7 RedHat kernel-rt-0:3.10.0-957.27.2.rt56.940.el7 *
Red Hat Enterprise Linux 7 RedHat kernel-0:3.10.0-957.27.2.el7 *
Red Hat Enterprise Linux 7 RedHat kernel-alt-0:4.14.0-115.26.1.el7a *
Red Hat Enterprise Linux 7.4 Advanced Update Support RedHat kernel-0:3.10.0-693.61.1.el7 *
Red Hat Enterprise Linux 7.4 Telco Extended Update Support RedHat kernel-0:3.10.0-693.61.1.el7 *
Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions RedHat kernel-0:3.10.0-693.61.1.el7 *
Red Hat Enterprise Linux 7.5 Extended Update Support RedHat kernel-0:3.10.0-862.46.1.el7 *
Red Hat Enterprise Linux 8 RedHat kernel-rt-0:4.18.0-80.7.1.rt9.153.el8_0 *
Red Hat Enterprise Linux 8 RedHat kernel-0:4.18.0-80.7.1.el8_0 *
Red Hat Enterprise MRG 2 RedHat kernel-rt-1:3.10.0-693.61.1.rt56.656.el6rt *
Linux Ubuntu cosmic *
Linux Ubuntu precise/esm *
Linux Ubuntu trusty/esm *
Linux Ubuntu upstream *
Linux-aws Ubuntu cosmic *
Linux-aws Ubuntu upstream *
Linux-aws-hwe Ubuntu upstream *
Linux-azure Ubuntu cosmic *
Linux-azure Ubuntu trusty/esm *
Linux-azure Ubuntu upstream *
Linux-azure-edge Ubuntu upstream *
Linux-euclid Ubuntu esm-apps/xenial *
Linux-euclid Ubuntu upstream *
Linux-euclid Ubuntu xenial *
Linux-flo Ubuntu esm-apps/xenial *
Linux-flo Ubuntu upstream *
Linux-flo Ubuntu xenial *
Linux-gcp Ubuntu cosmic *
Linux-gcp Ubuntu upstream *
Linux-gcp-edge Ubuntu upstream *
Linux-gke Ubuntu upstream *
Linux-gke Ubuntu xenial *
Linux-gke-4.15 Ubuntu upstream *
Linux-gke-5.0 Ubuntu upstream *
Linux-goldfish Ubuntu esm-apps/xenial *
Linux-goldfish Ubuntu upstream *
Linux-goldfish Ubuntu xenial *
Linux-grouper Ubuntu upstream *
Linux-hwe Ubuntu bionic *
Linux-hwe Ubuntu esm-infra/bionic *
Linux-hwe Ubuntu upstream *
Linux-hwe-edge Ubuntu upstream *
Linux-kvm Ubuntu cosmic *
Linux-kvm Ubuntu upstream *
Linux-lts-trusty Ubuntu precise/esm *
Linux-lts-trusty Ubuntu upstream *
Linux-lts-utopic Ubuntu upstream *
Linux-lts-vivid Ubuntu upstream *
Linux-lts-wily Ubuntu upstream *
Linux-lts-xenial Ubuntu trusty/esm *
Linux-lts-xenial Ubuntu upstream *
Linux-maguro Ubuntu upstream *
Linux-mako Ubuntu esm-apps/xenial *
Linux-mako Ubuntu upstream *
Linux-mako Ubuntu xenial *
Linux-manta Ubuntu upstream *
Linux-oem Ubuntu upstream *
Linux-oem Ubuntu xenial *
Linux-oracle Ubuntu upstream *
Linux-raspi2 Ubuntu cosmic *
Linux-raspi2 Ubuntu upstream *
Linux-snapdragon Ubuntu upstream *

Extended Description

The use of previously-freed memory can have any number of adverse consequences, ranging from the corruption of valid data to the execution of arbitrary code, depending on the instantiation and timing of the flaw. The simplest way data corruption may occur involves the system’s reuse of the freed memory. Use-after-free errors have two common and sometimes overlapping causes:

In this scenario, the memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.

Potential Mitigations

References