CVE-2019-19377

What it actually does

Use-after-free in btrfs_queue_work triggered by mounting a crafted btrfs filesystem image, performing operations, and unmounting on Linux kernel 5.0.21.

Why it matters to the business

Local attackers can achieve code execution or system crashes on affected Linux and NetApp systems, risking data corruption, service disruption, and potential privilege escalation with moderate exploitability indicated by stable low EPSS.

How an attack unfolds

An attacker prepares a malicious btrfs image, mounts it on a vulnerable system, issues targeted operations that queue work items, then unmounts to trigger the freed memory reference in the async thread handling path.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the btrfs async-thread use-after-free; apply vendor patches for NetApp products; avoid mounting untrusted btrfs images until patched.

How to confirm the fix worked

Verify kernel version exceeds 5.0.21 and contains btrfs async-thread fixes; attempt controlled mount/unmount tests with known-good images on isolated systems; review kernel source for absence of the vulnerable btrfs_queue_work path.

Typical attack path

1. Craft or obtain a malicious btrfs filesystem image
2. Mount the image on a target Linux system running vulnerable kernel
3. Perform filesystem operations that exercise btrfs work queueing
4. Unmount the image to dereference freed memory in btrfs_queue_work
5. Leverage resulting UAF for code execution or denial of service

How to detect it

Search kernel logs for btrfs-related oops or panic messages referencing async-thread.c or work queue errors around mount/unmount events; inspect audit logs for unusual btrfs mount activity from untrusted sources.

• btrfs_queue_work
• fs/btrfs/async-thread.c
• btrfs: failed to submit bio in async thread

What your security team should do

• Prioritize kernel upgrades on all affected Linux and NetApp deployments given public exploit availability
• Restrict mounting of untrusted or external btrfs images via policy and filesystem mount options
• Monitor EPSS and exploit maturity indicators for any increase in observed attempts
• Harden systems by disabling btrfs module if not required