Vulnerability Details : CVE-2019-15538
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
Vulnerability category: Denial of service
Products affected by CVE-2019-15538
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.3:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.3:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.3:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.3:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.3:rc5:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.3:rc6:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:aff_a700s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-15538
13.46%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-15538
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2019-15538
-
The product does not properly control the allocation and maintenance of a limited resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-15538
-
https://usn.ubuntu.com/4144-1/
USN-4144-1: Linux kernel vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://security.netapp.com/advisory/ntap-20191004-0001/
September 2019 Linux Kernel Vulnerabilities in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://lore.kernel.org/linux-xfs/20190823035528.GH1037422@magnolia/
[PATCH] xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT - Darrick J. WongMailing List;Patch;Vendor Advisory
-
https://github.com/torvalds/linux/commit/1fb254aa983bf190cfd685d40c64a480a9bafaee
xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to E… · torvalds/linux@1fb254a · GitHubPatch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html
[SECURITY] [DLA 1919-1] linux-4.9 security updateMailing List;Third Party Advisory
-
https://support.f5.com/csp/article/K32592426?utm_source=f5support&utm_medium=RSS
Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html
[SECURITY] [DLA 1919-2] linux-4.9 security updateMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T4JZ6AEUKFWBHQAROGMQARJ274PQP2QP/
[SECURITY] Fedora 30 Update: kernel-5.2.11-200.fc30 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1fb254aa983bf190cfd685d40c64a480a9bafaee
kernel/git/torvalds/linux.git - Linux kernel source treeMailing List;Patch;Vendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O3RUDQJXRJQVGHCGR4YZWTQ3ECBI7TXH/
[SECURITY] Fedora 29 Update: kernel-headers-5.2.11-100.fc29 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://lore.kernel.org/linux-xfs/20190823192433.GA8736@eldamar.local
Re: [PATCH] xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT - Salvatore BonaccorsoMailing List;Patch;Vendor Advisory
-
https://usn.ubuntu.com/4147-1/
USN-4147-1: Linux kernel vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html
[security-announce] openSUSE-SU-2019:2173-1: important: Security updateMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
[security-announce] openSUSE-SU-2019:2181-1: important: Security updateMailing List;Third Party Advisory
Jump to