CVE-2019-13105

HIGH

Das U-Boot 2019.07-rc1-2019.07-rc4 - Use-After-Free in ext4 Filesystem Listing

Title source: llm

Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when listing files in a crafted ext4 filesystem.

Core 3

Core References

Patch, Third Party Advisory x_refsource_misc

Mailing List, Patch, Vendor Advisory x_refsource_misc

Third Party Advisory x_refsource_misc

CVSS v3 7.8

EPSS 0.0126

EPSS Percentile 65.7%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-415

Status published

Products (1)

denx/u-boot 2019.07 rc1 (4 CPE variants)

Published Aug 06, 2019

Tracked Since Feb 18, 2026