An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. A user can create their own PID namespace, and mount a FUSE filesystem. Upon interaction with this FUSE filesystem, if the userspace component is terminated via a kill of the PID namespace's pid 1, it will result in a hung task, and resources being permanently locked up until system reboot. This can result in resource exhaustion.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2020/08/24/1 | Mailing List Third Party Advisory |
| https://github.com/sargun/fuse-example | Exploit Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20200608-0001/ | Third Party Advisory |
| https://sourceforge.net/p/fuse/mailman/message/36598753/ | Exploit Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2020/08/24/1 | Mailing List Third Party Advisory |
| https://github.com/sargun/fuse-example | Exploit Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20200608-0001/ | Third Party Advisory |
| https://sourceforge.net/p/fuse/mailman/message/36598753/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 04:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2020/08/24/1 - Mailing List, Third Party Advisory | |
| References | () https://github.com/sargun/fuse-example - Exploit, Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20200608-0001/ - Third Party Advisory | |
| References | () https://sourceforge.net/p/fuse/mailman/message/36598753/ - Exploit, Third Party Advisory |
Information
Published : 2020-05-09 18:15
Updated : 2024-11-21 04:39
NVD link : CVE-2019-20794
Mitre link : CVE-2019-20794
CVE.ORG link : CVE-2019-20794
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-772
Missing Release of Resource after Effective Lifetime