Bug 1784740 (CVE-2019-19725) - CVE-2019-19725 sysstat: double free in check_file_actlst() in sa_common.c may lead to arbitrary code execution
Summary: CVE-2019-19725 sysstat: double free in check_file_actlst() in sa_common.c may...
Alias: CVE-2019-19725
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1785293
Blocks: 1784742
TreeView+ depends on / blocked
Reported: 2019-12-18 08:50 UTC by Marian Rehak
Modified: 2023-03-24 16:30 UTC (History)
4 users (show)

Fixed In Version: sysstat 12.2.1
Doc Type: If docs needed, set a value
Doc Text:
A double-free vulnerability was found in sysstat in the way the `sadf` command processes the contents of data files created by the `sar` command. Saved binary data files with support for `extra_desc` structures may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially crafted file with malformed data that, when loaded by a victim, would cause the application to potentially execute arbitrary code.
Clone Of:
Last Closed: 2019-12-27 20:09:26 UTC

Attachments (Terms of Use)

Description Marian Rehak 2019-12-18 08:50:56 UTC
Sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.

Upstream Issue:


Comment 1 Dave Baker 2019-12-19 15:54:29 UTC
Created sysstat tracking bugs for this issue:

Affects: fedora-all [bug 1785293]

Comment 2 Mauro Matteo Cascella 2019-12-27 11:36:55 UTC
Upstream fix:

Comment 3 Mauro Matteo Cascella 2019-12-27 15:55:54 UTC
The flaw has been introduced upstream in version 12.1.7 with an update to sar/sadf to handle a possible new file format in saved binary data files: 


More specifically, new code has been included in function check_file_actlst() to check if extra structures (`extra_desc`) are present in saved files. In case of malformed data, a previously freed buffer is freed again, leading to a double free vulnerability.

The patch assigns a NULL value to the buffer pointer after the first free(). This implicitly avoids the second free(), which only occurs if the buffer is not NULL.

Comment 4 Mauro Matteo Cascella 2019-12-27 17:42:57 UTC

This flaw does not affect the versions of sysstat as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as they do not include support for `extra_desc` structures in binary data files created by the `sar` command. Consequently, they do not include the vulnerable code leading to the double free vulnerability either.

Comment 5 Product Security DevOps Team 2019-12-27 20:09:26 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.