CVE-2019-15791 EXPLOIT
7.1
HIGH · CVSS 3.1 · EPSS 1.3% (pctl 70)
Patch early
A public exploit exists.
Description
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the btrfs ioctl completes this fd is closed, which then puts a reference to that file, leading to a refcount underflow.
Scoring
| CVSS | 7.1 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
| EPSS | 1.32% — more likely to be exploited than 70% of all CVEs |
| Weakness | CWE-672 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2020-04-24 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| canonical | ubuntu linux |
| linux | linux kernel |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Ubuntu 19.10 - Refcount Underflow and Type Confusion in shiftfs | 2019-11-20 |
References
- https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=601a64857b3d7040ca15c39c929e6b9db3373ec1
- https://usn.ubuntu.com/usn/usn-4183-1
- https://usn.ubuntu.com/usn/usn-4184-1
- https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=601a64857b3d7040ca15c39c929e6b9db3373ec1
- https://usn.ubuntu.com/usn/usn-4183-1
- https://usn.ubuntu.com/usn/usn-4184-1
→ the Explorer · watch your stack · NVD