CVE-2019-18814

CRITICAL EPSS 82.7%

Published Nov 7, 20196y ago · Modified Jun 17, 20262w ago

9.8 CVSS 3.1

Critical

Published Nov 7, 2019 6y ago

Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c.

CVSS Details

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

82.7% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 1

Vendor	Product	Version	Range
linux	linux_kernel	*	≤5.3.9

References 4

lists.debian.org https://lists.debian.org/debian-lts-announce/2020/08/msg00019.html
lore.kernel.org https://lore.kernel.org/patchwork/patch/1142523/

Mailing ListPatchThird Party Advisory
security.netapp.com https://security.netapp.com/advisory/ntap-20191205-0001/
support.f5.com https://support.f5.com/csp/article/K21561554?utm_source=f5support&amp%3Butm_medium=RSS

Remediation

lore.kernel.org https://lore.kernel.org/patchwork/patch/1142523/

Mailing ListPatchThird Party Advisory