CVE-2019-18874 Double Free in psutil
A double free vulnerability in psutil allows attackers to cause denial of service or potentially execute arbitrary code via refcount mishandling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-18874?
CVE-2019-18874 is a high-severity use after free vulnerability in n/a, published on 12 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
Weakness: CWE-415
Which versions are affected by CVE-2019-18874?
3 open source packages ship an affected version, including psutil. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
psutil PyPI | All versions | 5.6.6 |
psutil PyPI | All versions | 5.6.6 |
psutil PyPI | All versions | 5.6.6 |
Linux distribution packages (15)
python3-psutil AlmaLinux:8 | All versions | 5.4.3-11.el8 |
python-psutil Red Hat:enterprise_linux:8::appstream | All versions | 0:5.4.3-11.el8 |
python-psutil-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:5.4.3-11.el8 |
python3-psutil Red Hat:enterprise_linux:8::appstream | All versions | 0:5.4.3-11.el8 |
python3-psutil-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:5.4.3-11.el8 |
python-psutil Red Hat:openshift:4.2::el7 | All versions | 0:5.6.6-1.el7ar |
python-psutil-debuginfo Red Hat:openshift:4.2::el7 | All versions | 0:5.6.6-1.el7ar |
python2-psutil Red Hat:openshift:4.2::el7 | All versions | 0:5.6.6-1.el7ar |
python-psutil Red Hat:openshift:4.3::el7 | All versions | 0:5.6.6-1.el7ar |
python-psutil-debuginfo Red Hat:openshift:4.3::el7 | All versions | 0:5.6.6-1.el7ar |
python2-psutil Red Hat:openshift:4.3::el7 | All versions | 0:5.6.6-1.el7ar |
python-psutil Red Hat:openshift:4.4::el7 | All versions | 0:5.6.6-1.el7ar |
python-psutil-debuginfo Red Hat:openshift:4.4::el7 | All versions | 0:5.6.6-1.el7ar |
python2-psutil Red Hat:openshift:4.4::el7 | All versions | 0:5.6.6-1.el7ar |
python-psutil Rocky Linux:8 | All versions | 0:5.4.3-11.el8 |
Products include Psutil Project Psutil.
How do I fix CVE-2019-18874?
Upgrade psutil to 5.6.6 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2019-18874 being exploited?
There is no known exploitation of CVE-2019-18874 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2019-18874, ALSA-2021:4324, AZL-6810, DEBIAN-CVE-2019-18874, DLA-1998-1, GHSA-qfc5-mcwq-26q8 and 10 more.