CVE-2019-20892 Use after free in n/a
A double free vulnerability in net-snmp allows attackers to cause denial of service or potentially execute code via crafted SNMPv3 requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-20892?
CVE-2019-20892 is a medium-severity use after free vulnerability in Oracle Zfs Storage Appliance Kit, published on 25 Jun 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.
Weakness: CWE-415
Which versions are affected by CVE-2019-20892?
It affects 2 products.
Linux distribution packages (18)
net-snmp Red Hat:enterprise_linux:8::appstream | All versions | 1:5.8-12.el8_1.1 |
net-snmp-agent-libs Red Hat:enterprise_linux:8::appstream | All versions | 1:5.8-12.el8_1.1 |
net-snmp-agent-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:5.8-12.el8_1.1 |
net-snmp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:5.8-12.el8_1.1 |
net-snmp-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:5.8-12.el8_1.1 |
net-snmp-devel Red Hat:enterprise_linux:8::appstream | All versions | 1:5.8-12.el8_1.1 |
net-snmp-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:5.8-12.el8_1.1 |
net-snmp-perl-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:5.8-12.el8_1.1 |
net-snmp-utils Red Hat:enterprise_linux:8::appstream | All versions | 1:5.8-12.el8_1.1 |
net-snmp-utils-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:5.8-12.el8_1.1 |
net-snmp Red Hat:enterprise_linux:8::baseos | All versions | 1:5.8-12.el8_1.1 |
net-snmp-agent-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:5.8-12.el8_1.1 |
net-snmp-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:5.8-12.el8_1.1 |
net-snmp-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 1:5.8-12.el8_1.1 |
net-snmp-libs Red Hat:enterprise_linux:8::baseos | All versions | 1:5.8-12.el8_1.1 |
net-snmp-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:5.8-12.el8_1.1 |
net-snmp-perl-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:5.8-12.el8_1.1 |
net-snmp-utils-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:5.8-12.el8_1.1 |
Products include Net-Snmp Net-Snmp, Oracle Zfs Storage Appliance Kit.
How do I fix CVE-2019-20892?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2019-20892 being exploited?
There is no known exploitation of CVE-2019-20892 in the wild and no public exploit code.
Other vulnerabilities in Oracle Zfs Storage Appliance Kit
Sources
Also known as ALPINE-CVE-2019-20892, DEBIAN-CVE-2019-20892, GHSA-8q2p-wr8q-hv7c, RHBA-2020:1376, UBUNTU-CVE-2019-20892, USN-4410-1.