A flaw was found in the Linux kernels BTRFS implementation which could allow for a slab-out-of-bounds write when an attacker is able to mount a specifically crafted BTRFS disk or disk image. The attacker must create an image with unexpected values to convince the kernel to write disk metadata information in the wrong location. This could allow for memory corruption or possibly privilege escalation. Reference: https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19378
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1781900]
This flaw is rated as moderate, as it requires a local user (usually privileged) to mount a corrupt filesystem.
Mitigation: As the BTRFS module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions: # echo "install btrfs /bin/true" >> /etc/modprobe.d/disable-btrfs.conf The system will need to be restarted if the BTRFS modules are loaded, it may be possible to unload them. In most circumstances, the BTRFS kernel modules will be unable to be unloaded while any BTRFS filesystems are mounted or in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.
Statement: This issue is considered as having Low impact because it needs physical access to trigger and it's also in Technology Preview functionality. For more information regarding BTRFS support in Red Hat Enterprise Linux 6 and 7 refer to https://access.redhat.com/solutions/197643 .
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-19378