CVE-2019-19770

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of debugfs within blktrace

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html
https://bugzilla.kernel.org/show_bug.cgi?id=205713Exploit, Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
https://lore.kernel.org/linux-block/20200402000002.7442-1-mcgrof%40kernel.org/
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html
https://bugzilla.kernel.org/show_bug.cgi?id=205713Exploit, Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
https://lore.kernel.org/linux-block/20200402000002.7442-1-mcgrof%40kernel.org/
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory

Timeline

Published: Dec 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-197718.8The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In part CVE-2019-197725.4Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are avail CVE-2019-197735.4Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are availabl CVE-2019-197748.8An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails"CVE-2019-197756.1The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users.CVE-2019-197778.8stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.CVE-2019-197788.8An issue was discovered in libsixel 1.8.2. There is a heap-based buffer over-read in the function load_sixel at loader.c.CVE-2019-19785.8A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, an CVE-2019-197819.8An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory T CVE-2019-197829.8The FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP server.CVE-2019-197836.5An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x CVE-2019-197857.8ATasm 1.06 has a stack-based buffer overflow in the to_comma() function in asm.c via a crafted .m65 file.