CVE-2019-8912

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-02-18 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
Linux kernel: from 4.10 before 4.14.103; from 4.19 before 4.19.25; from 4.20 before 4.20.12; 5.0-rc1, 5.0-rc2, 5.0-rc3, 5.0-rc4, 5.0-rc5, 5.0-rc6 (+2) — fixed in 4.14.103, 4.19.25, 4.20.12
openSUSE Leap: 15.0
Red Hat Enterprise Linux: 7.0

How to fix

Upgrade to a fixed version: Linux kernel 4.14.103, 4.19.25, 4.20.12. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html
http://patchwork.ozlabs.org/patch/1042902/
http://www.securityfocus.com/bid/107063
https://access.redhat.com/errata/RHSA-2020:0174
https://usn.ubuntu.com/3930-1/
https://usn.ubuntu.com/3930-2/
https://usn.ubuntu.com/3931-1/
https://usn.ubuntu.com/3931-2/
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-8912
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html
http://patchwork.ozlabs.org/patch/1042902/
http://www.securityfocus.com/bid/107063

Get alerted when CVE-2019-8912 or the next vulnerability affects your stack