CVE-2019-15794

What it actually does

The vulnerability causes a reference count underflow in the kernel's virtual memory area handling when an error occurs during mmap operations involving OverlayFS or shiftfs combined with the aufs patch, leading to a use-after-free condition.

Why it matters to the business

Attackers with local high-privileged access could exploit this to escalate privileges and compromise the entire system, affecting stability and security of Ubuntu Linux deployments using affected kernels.

How an attack unfolds

An attacker with local access and high privileges crafts a scenario that triggers an error in the mmap handler for overlay or shift filesystems, causing the refcount underflow and subsequent use-after-free that can be leveraged for code execution; public exploits are available.

How to fix it

Apply kernel updates from Canonical or upstream Linux to address the refcount handling issue in OverlayFS and shiftfs mmap error paths.

How to confirm the fix worked

Verify kernel version is updated beyond affected 5.0/5.3 series and test that mmap error paths properly restore vm_file references without underflow.

Typical attack path

1. Obtain local access with high privileges on an affected Ubuntu system
2. Trigger error path in mmap with overlayfs/shiftfs and aufs configuration
3. Exploit use-after-free for privilege escalation and kernel control

How to detect it

Inspect kernel logs for memory reference errors or crashes involving vm_file during mmap operations; look for anomalous local processes attempting to trigger filesystem mmap errors on overlay or shift filesystems.

What your security team should do

• Prioritize kernel updates on affected Ubuntu systems due to available exploits
• Monitor for local privilege escalation attempts targeting kernel memory
• Restrict high-privileged local access and avoid aufs with overlayfs where possible