CVE-2019-15791: canonical ubuntu_linux

Vulnerability summary

CVE-2019-15791 is a high (CVSS 7.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 1.32% chance of exploitation in the next 30 days, higher than 70.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-04-2020
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the btrfs ioctl completes this fd is closed, which then puts a reference to that file, leading to a refcount underflow.

• CWE-672Operation on a Resource after Expiration or ReleaseThe product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
• CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.