CVE-2019-11833

Published: May 15, 2019Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.

Affected (32)

Products: Linux: Linux Kernel · Fedoraproject: Fedora · Debian: Debian Linux · +2 more

Show all products

1 product

1 product

1 product

1 product

11 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux For Real Time

Enterprise Linux For Real Time For Nfv

Enterprise Linux For Real Time For Nfv Tus

Enterprise Linux For Real Time Tus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Up to 5.1.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04

Configuration E

24 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Eus	Version 8.1
Redhat Enterprise Linux Eus	Version 8.2
Redhat Enterprise Linux Eus	Version 8.4
Redhat Enterprise Linux Eus	Version 8.6
Redhat Enterprise Linux For Real Time	Version 7
Redhat Enterprise Linux For Real Time	Version 8.0
Redhat Enterprise Linux For Real Time For Nfv	Version 7
Redhat Enterprise Linux For Real Time For Nfv	Version 8.0
Redhat Enterprise Linux For Real Time For Nfv Tus	Version 8.2
Redhat Enterprise Linux For Real Time For Nfv Tus	Version 8.4
Redhat Enterprise Linux For Real Time For Nfv Tus	Version 8.6
Redhat Enterprise Linux For Real Time Tus	Version 8.2
Redhat Enterprise Linux For Real Time Tus	Version 8.4
Redhat Enterprise Linux For Real Time Tus	Version 8.6
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 8.2
Redhat Enterprise Linux Server Aus	Version 8.4
Redhat Enterprise Linux Server Aus	Version 8.6
Redhat Enterprise Linux Server Tus	Version 8.2
Redhat Enterprise Linux Server Tus	Version 8.4
Redhat Enterprise Linux Server Tus	Version 8.6
Redhat Enterprise Linux Workstation	Version 7.0

Related CWEs

CWE-908

Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

References (44)

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html

Source: cve@mitre.org

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html

Source: cve@mitre.org

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html

Source: cve@mitre.org

Broken Link

http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/108372

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2019:2029

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2043

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3309

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3517

Source: cve@mitre.org

Third Party Advisory

https://github.com/torvalds/linux/commit/592acbf16821288ecdc4192c47e3774a4c48bb64

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/06/msg00010.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJGZIMGB72TL7OGWRMHIL43WHXFQWU4X/

Source: cve@mitre.org

https://seclists.org/bugtraq/2019/Jun/26

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://usn.ubuntu.com/4068-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4068-2/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4069-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4069-2/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4076-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4095-2/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4118-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4465

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html