CVE-2019-19767 in Ubuntu

CVE-2019-19767

Priority

Description

The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as
demonstrated by use-after-free errors in __ext4_expand_extra_isize and
ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka
CID-4ea99936a163.

Ubuntu-Description

It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle certain conditions. An attacker could use
this to specially craft an ext4 file system that, when mounted, could cause
a denial of service (system crash) or possibly execute arbitrary code.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19767
https://git.kernel.org/linus/4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a
https://bugzilla.kernel.org/show_bug.cgi?id=205609
https://bugzilla.kernel.org/show_bug.cgi?id=205707
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a
https://github.com/torvalds/linux/commit/4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a
https://ubuntu.com/security/notices/USN-4258-1
https://ubuntu.com/security/notices/USN-4284-1
https://ubuntu.com/security/notices/USN-4287-1
https://ubuntu.com/security/notices/USN-4287-2

Notes

Package

Source: linux (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (4.15.0-88.88)
Ubuntu 20.04 LTS:	not-affected (5.4.0-9.12)
Ubuntu 16.04 ESM:	not-affected (4.2.0-16.19)
Ubuntu 14.04 ESM:	not-affected (3.11.0-12.19)

Patches:

Introduced by c03b45b853f5829816d871283c792e7527a7ded1	Fixed by 4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a
Introduced by 7bc04c5c2cc467c5b40f2b03ba08da174a0d5fa7	Fixed by 4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a

Package

Source: linux-aws (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (4.15.0-1060.62)
Ubuntu 20.04 LTS:	not-affected (5.4.0-1005.5)
Ubuntu 16.04 ESM:	not-affected (4.4.0-1001.10)
Ubuntu 14.04 ESM:	not-affected (4.4.0-1002.2)

Patches:

Package

Source: linux-aws-5.0 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.0.0-1024.27~18.04.1)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-aws-5.3 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	not-affected (5.3.0-1016.17~18.04.1)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-aws-hwe (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	DNE
Ubuntu 20.04 LTS:	DNE
Ubuntu 16.04 ESM:	released (4.15.0-1060.62~16.04.1)
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-azure (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.0.0-1029.31~18.04.1)
Ubuntu 20.04 LTS:	not-affected (5.4.0-1006.6)
Ubuntu 16.04 ESM:	released (4.15.0-1071.76)
Ubuntu 14.04 ESM:	released (4.15.0-1071.76~14.04.1)

Patches:

Package

Source: linux-azure-4.15 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	not-affected (4.15.0-1082.92)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-azure-5.3 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.3.0-1013.14~18.04.1)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-azure-edge (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	ignored (was needs-triage now end-of-life)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-gcp (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.0.0-1029.30~18.04.1)
Ubuntu 20.04 LTS:	not-affected (5.4.0-1005.5)
Ubuntu 16.04 ESM:	released (4.15.0-1055.59)
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-gcp-4.15 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	not-affected (4.15.0-1071.81)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-gcp-5.3 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.3.0-1012.13~18.04.1)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-gcp-edge (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	ignored (was needs-triage now end-of-life)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-gke-4.15 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (4.15.0-1052.55)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-gke-5.0 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.0.0-1029.30~18.04.1)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-gke-5.3 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.3.0-1012.13~18.04.1)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-hwe (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.3.0-40.32~18.04.1)
Ubuntu 20.04 LTS:	DNE
Ubuntu 16.04 ESM:	released (4.15.0-88.88~16.04.1)
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-hwe-edge (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	ignored (was needs-triage now end-of-life)
Ubuntu 20.04 LTS:	DNE
Ubuntu 16.04 ESM:	ignored (was needs-triage now end-of-life)
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-kvm (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (4.15.0-1053.53)
Ubuntu 20.04 LTS:	not-affected (5.4.0-1004.4)
Ubuntu 16.04 ESM:	not-affected (4.4.0-1004.9)
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-lts-trusty (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	DNE
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-lts-xenial (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	DNE
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	not-affected (4.4.0-13.29~14.04.1)

Patches:

Package

Source: linux-oem (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (4.15.0-1073.83)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-oem-5.6 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	DNE
Ubuntu 20.04 LTS:	not-affected (5.6.0-1007.7)
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-oem-osp1 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.0.0-1037.42)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-oracle (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (4.15.0-1033.36)
Ubuntu 20.04 LTS:	not-affected (5.4.0-1005.5)
Ubuntu 16.04 ESM:	released (4.15.0-1033.36~16.04.1)
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-oracle-5.0 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.0.0-1010.15~18.04.1)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-oracle-5.3 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	not-affected (5.3.0-1011.12~18.04.1)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-raspi (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	DNE
Ubuntu 20.04 LTS:	not-affected (5.4.0-1007.7)
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-raspi2 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (4.15.0-1055.59)
Ubuntu 20.04 LTS:	ignored (was needed now end-of-life)
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-raspi2-5.3 (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (5.3.0-1018.20~18.04.1)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-riscv (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	DNE
Ubuntu 20.04 LTS:	not-affected (5.4.0-24.28)
Ubuntu 14.04 ESM:	DNE

Patches:

Package

Source: linux-snapdragon (LP Ubuntu Debian)

Upstream:	released (5.5~rc1)
Ubuntu 18.04 LTS:	released (4.15.0-1072.79)
Ubuntu 20.04 LTS:	DNE
Ubuntu 14.04 ESM:	DNE

Patches:

More Information

Updated: 2022-04-13 13:53:33 UTC (commit f411bd370d482ef4385c4e751d121a4055fbc009)