CVE-2019-19816

HIGH

Linux Kernel 2.6.12-4.4.247 - Out-of-bounds Write in Btrfs Volume Mapping

Title source: llm
STIX 2.1

Description

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.

References (6)

Core 6
Core References
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20200103-0001/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4414-1/
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html

Scores

CVSS v3 7.8
EPSS 0.0115
EPSS Percentile 78.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (15)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
debian/debian_linux 9.0
linux/linux_kernel 2.6.12 - 4.4.247
netapp/active_iq_unified_manager 9.5
netapp/aff_a400_firmware
netapp/aff_a700s_firmware
netapp/data_availability_services
netapp/fas8300_firmware
... and 5 more
Published Dec 17, 2019
Tracked Since Feb 18, 2026