Bug 1781899 (CVE-2019-19378) - CVE-2019-19378 kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c
Summary: CVE-2019-19378 kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/ra...
Alias: CVE-2019-19378
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1781900
Blocks: 1781901
TreeView+ depends on / blocked
Reported: 2019-12-10 20:49 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-02-16 20:55 UTC (History)
47 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the BTRFS implementation in the Linux kernel. A slab-out-of-bounds write occurs when an attacker can mount a specially crafted BTRFS disk or disk image.
Clone Of:
Last Closed: 2020-05-06 16:31:53 UTC

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2019-12-10 20:49:38 UTC
A flaw was found in the Linux kernels BTRFS implementation which could allow for a slab-out-of-bounds write when an attacker is able to mount a specifically crafted BTRFS disk or disk image.

The attacker must create an image with unexpected values to convince the kernel to write disk metadata information in the wrong location.

This could allow for memory corruption or possibly privilege escalation.


Comment 1 Guilherme de Almeida Suckevicz 2019-12-10 20:52:12 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1781900]

Comment 3 Wade Mealing 2020-04-01 06:34:09 UTC
This flaw is rated as moderate, as it requires a local user (usually privileged) to mount a corrupt filesystem.

Comment 5 Wade Mealing 2020-04-05 23:38:50 UTC

As the BTRFS module will be auto-loaded when required, its use can be disabled  by preventing the module from loading with the following instructions:

# echo "install btrfs /bin/true" >> /etc/modprobe.d/disable-btrfs.conf

The system will need to be restarted if the BTRFS modules are loaded, it may be possible to unload them. In most circumstances, the BTRFS kernel modules will be unable to be unloaded while any BTRFS filesystems are mounted or in use.

If the system requires this module to work correctly, this mitigation may not be suitable.

If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

Comment 7 Petr Matousek 2020-04-16 14:12:54 UTC

This issue is considered as having Low impact because it needs physical access to trigger and it's also in Technology Preview functionality. For more information regarding BTRFS support in Red Hat Enterprise Linux 6 and 7 refer to https://access.redhat.com/solutions/197643 .

Comment 8 Product Security DevOps Team 2020-05-06 16:31:53 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.