CVE-2019-15538 Denial of service in n/a
A local attacker can cause a denial of service in the Linux kernel XFS filesystem by triggering a chgrp failure due to disk quota exhaustion, potentially affecting remote users via NFS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15538?
CVE-2019-15538 is a high-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 25 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
Weakness: CWE-400
Which versions are affected by CVE-2019-15538?
It affects 18 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Linux kernel, Netapp Aff A700s Firmware, Netapp Data Availability Services and 12 more.
How do I fix CVE-2019-15538?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-15538 being exploited?
There is no known exploitation of CVE-2019-15538 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2019-15538, GHSA-5v37-529g-93gg, UBUNTU-CVE-2019-15538.