CVE-2019-19039

 

Published at: - 21-11-2019 03:15

Last modified: - 26-10-2022 01:44

Total changes: - 5

Description

** DISPUTED ** __btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as not being a vulnerability because “1) The kernel provide facilities to restrict access to dmesg - dmesg_restrict=1 sysctl option. So it's really up to the system administrator to judge whether dmesg access shall be disallowed or not. 2) WARN/WARN_ON are widely used macros in the linux kernel. If this CVE is considered valid this would mean there are literally thousands CVE lurking in the kernel - something which clearly is not the case.�

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19039
• USN-4414-1-Third Party Advisory
• [debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2019-19039

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures