CVE:CVE-2019-8912
CNNVD:CNNVD-201902-720
Linux kernel是美国Linux基金会的发布的开源操作系统Linux所使用的内核。
Linux kernel 4.20.10及之前版本中的sockfs_setattr存在释放后重用漏洞，该漏洞源于crypto/af_alg.c文件的‘af_alg_release()’函数没有将结构体成员设置成空值。攻击者可利用该漏洞在系统上执行任意代码。
solution:Upgrade linux linux_kernel to a higher version than 4.14.103,4.19.25,4.20.12,5.0:rc1,5.0:rc2,5.0:rc3,5.0:rc4,5.0:rc5,5.0:rc6,5.0:rc7,5.0:rc8,and avoid the version [4.10,4.14.103),[4.19,4.19.25),[4.20,4.20.12),5.0:rc1,5.0:rc2,5.0:rc3,5.0:rc4,5.0:rc5,5.0:rc6,5.0:rc7,5.0:rc8; Upgrade redhat enterprise_linux to a higher version than 7.0,and avoid the version 7.0; Upgrade canonical ubuntu_linux to a higher version than 14.04,16.04,18.04,18.10,and avoid the version 14.04,16.04,18.04,18.10; Upgrade opensuse leap to a higher version than 15.0,and avoid the version 15.0