CVE-2019-11833

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.

CVSS v3.0 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3.0 : MEDIUM

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/torvalds/linux/commit/592acbf16821288ecdc4192c47e3774a4c48bb64	Patch Third Party Advisory
http://www.securityfocus.com/bid/108372
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GJGZIMGB72TL7OGWRMHIL43WHXFQWU4X/
https://www.debian.org/security/2019/dsa-4465
https://lists.debian.org/debian-lts-announce/2019/06/msg00010.html
https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html
https://seclists.org/bugtraq/2019/Jun/26
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html
https://usn.ubuntu.com/4068-1/
https://usn.ubuntu.com/4068-2/
https://usn.ubuntu.com/4069-1/
https://usn.ubuntu.com/4076-1/
https://usn.ubuntu.com/4069-2/
https://access.redhat.com/errata/RHSA-2019:2043
https://access.redhat.com/errata/RHSA-2019:2029
https://usn.ubuntu.com/4095-2/
https://usn.ubuntu.com/4118-1/
http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
https://access.redhat.com/errata/RHSA-2019:3517
https://access.redhat.com/errata/RHSA-2019:3309

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Information

Published : 2019-05-15 13:29

Updated : 2020-08-24 17:37

NVD link : CVE-2019-11833

Mitre link : CVE-2019-11833

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-908

Use of Uninitialized Resource

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/torvalds/linux/commit/592acbf16821288ecdc4192c47e3774a4c48bb64", "name": "https://github.com/torvalds/linux/commit/592acbf16821288ecdc4192c47e3774a4c48bb64", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/108372", "name": "108372", "tags": [], "refsource": "BID"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html", "name": "openSUSE-SU-2019:1479", "tags": [], "refsource": "SUSE"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GJGZIMGB72TL7OGWRMHIL43WHXFQWU4X/", "name": "FEDORA-2019-48b34fc991", "tags": [], "refsource": "FEDORA"}, {"url": "https://www.debian.org/security/2019/dsa-4465", "name": "DSA-4465", "tags": [], "refsource": "DEBIAN"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00010.html", "name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1823-1] linux security update", "tags": [], "refsource": "MLIST"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html", "name": "[debian-lts-announce] 20190618 [SECURITY] [DLA 1824-1] linux-4.9 security update", "tags": [], "refsource": "MLIST"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html", "name": "openSUSE-SU-2019:1570", "tags": [], "refsource": "SUSE"}, {"url": "https://seclists.org/bugtraq/2019/Jun/26", "name": "20190618 [SECURITY] [DSA 4465-1] linux security update", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html", "name": "openSUSE-SU-2019:1579", "tags": [], "refsource": "SUSE"}, {"url": "https://usn.ubuntu.com/4068-1/", "name": "USN-4068-1", "tags": [], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/4068-2/", "name": "USN-4068-2", "tags": [], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/4069-1/", "name": "USN-4069-1", "tags": [], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/4076-1/", "name": "USN-4076-1", "tags": [], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/4069-2/", "name": "USN-4069-2", "tags": [], "refsource": "UBUNTU"}, {"url": "https://access.redhat.com/errata/RHSA-2019:2043", "name": "RHSA-2019:2043", "tags": [], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2019:2029", "name": "RHSA-2019:2029", "tags": [], "refsource": "REDHAT"}, {"url": "https://usn.ubuntu.com/4095-2/", "name": "USN-4095-2", "tags": [], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/4118-1/", "name": "USN-4118-1", "tags": [], "refsource": "UBUNTU"}, {"url": "http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html", "name": "http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html", "tags": [], "refsource": "MISC"}, {"url": "https://access.redhat.com/errata/RHSA-2019:3517", "name": "RHSA-2019:3517", "tags": [], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2019:3309", "name": "RHSA-2019:3309", "tags": [], "refsource": "REDHAT"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-908"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-11833", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "LOW", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}}, "publishedDate": "2019-05-15T13:29Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "5.1.2"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-08-24T17:37Z"}