CVE Vulnerabilities

CVE-2019-18874

Double Free

Published: Nov 12, 2019 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
7 MODERATE
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

Weakness

The product calls free() twice on the same memory address.

Affected Software

Name Vendor Start Version End Version
Psutil Psutil_project * 5.6.5 (including)
Red Hat Ansible Tower 3.6 for RHEL 7 RedHat ansible-tower-36/ansible-runner-rhel7:1.4.4-2 *
Red Hat Ansible Tower 3.7 for RHEL 7 RedHat ansible-tower-37/ansible-runner-rhel7:1.4.6-2 *
Red Hat Ansible Tower 3.7 for RHEL 7 RedHat ansible-tower-37/ansible-tower-rhel7:3.7.4-1 *
Red Hat Enterprise Linux 8 RedHat python38:3.8-8050020210811101222.e3d35cca *
Red Hat Enterprise Linux 8 RedHat python38-devel:3.8-8050020210811101222.e3d35cca *
Red Hat Enterprise Linux 8 RedHat python-psutil-0:5.4.3-11.el8 *
Red Hat OpenShift Container Platform 4.2 RedHat python-psutil-0:5.6.6-1.el7ar *
Red Hat OpenShift Container Platform 4.3 RedHat python-psutil-0:5.6.6-1.el7ar *
Red Hat OpenShift Container Platform 4.4 RedHat python-psutil-0:5.6.6-1.el7ar *
Red Hat Satellite 6.9 for RHEL 7 RedHat python-psutil-0:5.7.2-2.el7sat *
Red Hat Satellite 6.9 for RHEL 7 RedHat python-psutil-0:5.7.2-2.el7sat *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-python38-python-0:3.8.6-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-python38-python-psutil-0:5.6.4-5.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-python38-python-urllib3-0:1.25.7-6.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS RedHat rh-python38-python-0:3.8.6-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS RedHat rh-python38-python-psutil-0:5.6.4-5.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS RedHat rh-python38-python-urllib3-0:1.25.7-6.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-python38-python-0:3.8.6-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-python38-python-psutil-0:5.6.4-5.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-python38-python-urllib3-0:1.25.7-6.el7 *
Python-psutil Ubuntu bionic *
Python-psutil Ubuntu devel *
Python-psutil Ubuntu disco *
Python-psutil Ubuntu eoan *
Python-psutil Ubuntu esm-infra/bionic *
Python-psutil Ubuntu esm-infra/xenial *
Python-psutil Ubuntu trusty *
Python-psutil Ubuntu xenial *

Potential Mitigations

References