CVE-2019-5188

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 08-01-2020 05:15

Last modified: - 12-05-2022 10:14

Total changes: - 7

Description

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Low

Attack complexity

Local

Attack vector

High

Availability

High

Confidentiality

High

Integrity

High

Privileges required

Unchanged

Scope

None

User interaction

6.7

Base score

0.8

5.9

Exploitability score

Impact score

Verification logic

vendor=e2fsprogs_project AND product=e2fsprogs AND versionEndIncluding=1.45.4 AND versionStartIncluding=1.43.3

vendor=fedoraproject AND product=fedora AND version=30

vendor=fedoraproject AND product=fedora AND version=31

vendor=Debian AND product=debian_linux AND version=8.0

vendor=Debian AND product=debian_linux AND version=9.0

vendor=canonical AND product=ubuntu_linux AND version=16.04 AND software_edition=lts

vendor=canonical AND product=ubuntu_linux AND version=12.04 AND software_edition=esm

vendor=canonical AND product=ubuntu_linux AND version=18.04 AND software_edition=lts

vendor=canonical AND product=ubuntu_linux AND version=19.04

vendor=canonical AND product=ubuntu_linux AND version=14.04 AND software_edition=esm

vendor=canonical AND product=ubuntu_linux AND version=19.10

vendor=opensuse AND product=leap AND version=15.1

AND

vendor=netapp AND product=hci_compute_node_firmware AND version=-

vendor=netapp AND product=hci_compute_node AND version=-

vendor=netapp AND product=solidfire\,_enterprise_sds_\&_hci_storage_node AND version=-

Reference

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973
FEDORA-2020-a724cc7926-Third Party Advisory
USN-4249-1-Third Party Advisory
FEDORA-2020-01ed02451f-Third Party Advisory
openSUSE-SU-2020:0166-Mailing List, Third Party Advisory
[debian-lts-announce] 20200324 [SECURITY] [DLA 2156-1] e2fsprogs security update-Mailing List, Third Party Advisory
[debian-lts-announce] 20200726 [SECURITY] [DLA 2290-1] e2fsprogs security update-Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20220506-0001/

Keywords

CVE-2019-5188

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2019-5188

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures