CVE-2019-19448

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19448Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
https://usn.ubuntu.com/4578-1/Third Party Advisory
https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19448Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
https://usn.ubuntu.com/4578-1/Third Party Advisory

Timeline

Published: Dec 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-194497.8In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manage CVE-2019-19457.8Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local at CVE-2019-194509.8paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in CVE-2019-194515.5When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an en CVE-2019-194527.8A buffer overflow was found in Patriot Viper RGB through 1.1 when processing IoControlCode 0x80102040. Local attackers (including low integr CVE-2019-194535.4Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). An authenticated user, with access to the proxy license editing is able to in CVE-2019-194547.5An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowz CVE-2019-194557.8Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / Wowz CVE-2019-194566.1A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <= CVE-2019-194575.4SALTO ProAccess SPACE 5.4.3.0 allows XSS.CVE-2019-194588.6SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature.CVE-2019-194599.8An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. An attacker can write arbitrary content to arbitrary files, as demonstrated by CVE