CVE-2019-19319

What it actually does

Use-after-free in ext4_xattr_set_entry allows slab-out-of-bounds write during setxattr on a maliciously crafted ext4 filesystem image when a large old_size value triggers an unsafe memset.

Why it matters to the business

Local attackers with the ability to supply or control ext4 images can achieve arbitrary kernel memory corruption, potentially leading to privilege escalation or system instability on servers and endpoints that process untrusted storage media.

How an attack unfolds

An attacker crafts an ext4 image that triggers the use-after-free in xattr handling, mounts the image on a vulnerable kernel, then issues a setxattr call with parameters that cause the out-of-bounds write; public exploit code exists to demonstrate the flaw.

How to fix it

Upgrade the Linux kernel to version 5.2 or later containing commit 345c0dbf3a30; rebuild and deploy the updated kernel across all affected systems; avoid mounting untrusted ext4 images until patched.

How to confirm the fix worked

Verify the running kernel version is 5.2 or newer and contains commit 345c0dbf3a30; attempt to reproduce the original setxattr sequence on a test image and confirm absence of the out-of-bounds write; review kernel build logs for the fix.

Typical attack path

1. Prepare and deliver a malicious ext4 filesystem image
2. Mount the image on the target system (requires local access or control of mount operations)
3. Invoke setxattr on a file within the mounted image using a large old_size value
4. Trigger the use-after-free and subsequent slab write to corrupt kernel memory
5. Leverage the corruption for privilege escalation or denial of service

How to detect it

Review kernel logs and audit records for unusual ext4 mount events followed by setxattr operations; inspect for crash dumps or slab allocator warnings referencing xattr handling; correlate with file accesses on newly mounted volumes.

What your security team should do

• Prioritize kernel updates on all systems that mount external or user-supplied ext4 volumes
• Implement mandatory kernel version checks in deployment pipelines
• Restrict unprivileged mount operations via SELinux/AppArmor or mount namespaces where feasible
• Monitor upstream stable kernel releases for backports of the fix