CVE-2019-20794CWE-772

CVE-2019-20794

Medium · published May 9, 2020

CVSS v3.1
4.7
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. A user can create their own PID namespace, and mount a FUSE filesystem. Upon interaction with this FUSE filesystem, if the userspace component is terminated via a kill of the PID namespace's pid 1, it will result in a hung task, and resources being permanently locked up until system reboot. This can result in resource exhaustion.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00512 · 42.8th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2020-05-09T22:15Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel≥ 4.18, ≤ 5.6.11—
References (8)
http://www.openwall.com/lists/oss-security/2020/08/24/1 · [email protected]https://github.com/sargun/fuse-example · [email protected]https://security.netapp.com/advisory/ntap-20200608-0001/ · [email protected]https://sourceforge.net/p/fuse/mailman/message/36598753/ · [email protected]http://www.openwall.com/lists/oss-security/2020/08/24/1 · af854a3a-2127-422b-91ae-364da2661108https://github.com/sargun/fuse-example · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200608-0001/ · af854a3a-2127-422b-91ae-364da2661108https://sourceforge.net/p/fuse/mailman/message/36598753/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 09 MAY 17:35Z
    An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed
    cvelistv5