CVE-2019-19447

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.htmlThird Party Advisory
https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19447Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.htmlThird Party Advisory
https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19447Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory

Timeline

Published: Dec 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-194487.8In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs syste CVE-2019-194497.8In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage CVE-2019-19457.8Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local at CVE-2019-194509.8paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in CVE-2019-194515.5When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an en CVE-2019-194527.8A buffer overflow was found in Patriot Viper RGB through 1.1 when processing IoControlCode 0x80102040. Local attackers (including low integr CVE-2019-194535.4Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). An authenticated user, with access to the proxy license editing is able to in CVE-2019-194547.5An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowz CVE-2019-194557.8Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / Wowz CVE-2019-194566.1A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <= CVE-2019-194575.4SALTO ProAccess SPACE 5.4.3.0 allows XSS.CVE-2019-194588.6SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature.