The Linux kernel before 5.1-rc5 allows page->refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipefs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-11487.json"
[
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 147.0,
"function_hash": "246661378984774640900291141426474065739"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f958d7b528b1b40c44cfda5eabe2d82760d868c3",
"id": "CVE-2019-11487-05428303",
"target": {
"file": "include/linux/mm.h",
"function": "get_page"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1596.0,
"function_hash": "188137618908441444825684155206012870081"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-05e81b8a",
"target": {
"file": "fs/fuse/dev.c",
"function": "fuse_dev_splice_write"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 106.0,
"function_hash": "30922410599226035518882723147952276485"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-1238921a",
"target": {
"file": "include/linux/pipe_fs_i.h",
"function": "pipe_buf_get"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"6852171943254351894554072880106002818",
"325208501415542900715633986829114465270",
"213095804286015837806783518709115218066",
"149917711389521261985348297358429579341"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8fde12ca79aff9b5ba951fce1a2641901b8d8e64",
"id": "CVE-2019-11487-2a3ce966",
"target": {
"file": "mm/hugetlb.c"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"199696771967834494027109219900851898140",
"302121261132131970874082410624726693754",
"294425788947633915339762799554942644554",
"154162773781904437901353005297631808314",
"230376393015780461484075442819287309278",
"175256527034700177957420911518441909183",
"218999701142339624725984770060309018353",
"287892070416892388267364692557030272316",
"282429924166075906003642118777812747972",
"157861114456579233397935545288016215206",
"60373477512358587729931053199723554415",
"33537300686045990007171153215143808432",
"316575824062744842152294326592822513312"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-2e2b7a69",
"target": {
"file": "include/linux/pipe_fs_i.h"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1948.0,
"function_hash": "174276328654731181381957440899776498180"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8fde12ca79aff9b5ba951fce1a2641901b8d8e64",
"id": "CVE-2019-11487-31c747a6",
"target": {
"file": "mm/hugetlb.c",
"function": "follow_hugetlb_page"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 120.0,
"function_hash": "283612010148318492528197249166185883708"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-3e648fba",
"target": {
"file": "kernel/trace/trace.c",
"function": "buffer_pipe_buf_get"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 786.0,
"function_hash": "289332777025763927130433838703451268308"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8fde12ca79aff9b5ba951fce1a2641901b8d8e64",
"id": "CVE-2019-11487-45fea292",
"target": {
"file": "mm/gup.c",
"function": "gup_huge_pud"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1405.0,
"function_hash": "230235247948162646073791680223882320773"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-553c7565",
"target": {
"file": "fs/splice.c",
"function": "splice_pipe_to_pipe"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 728.0,
"function_hash": "86528010038851890944301844486394435062"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8fde12ca79aff9b5ba951fce1a2641901b8d8e64",
"id": "CVE-2019-11487-55d2aae4",
"target": {
"file": "mm/gup.c",
"function": "gup_huge_pgd"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"167716320382893055691744117116930563390",
"171077054328399372861042079404617335364",
"308138696364167886937849274896980667879",
"321082180923710278742974825653451392004",
"110551336440009834936557926479907332723",
"284613427836562942163017275190234622328",
"12438149221517598441977613091246411757",
"170525055582880920553488695951319401055"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-9a78523d",
"target": {
"file": "fs/splice.c"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1064.0,
"function_hash": "317153718975474324749071452308542617109"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8fde12ca79aff9b5ba951fce1a2641901b8d8e64",
"id": "CVE-2019-11487-bfd9107b",
"target": {
"file": "mm/gup.c",
"function": "get_gate_page"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"120997154270509548080985598640891420026",
"130363969045229092740992938981427048107",
"13056636143657394172376177417844481866",
"323690954586297318957362954240775555131",
"263285053733507658027141342021229959502",
"258589596432227305511494095060602465071",
"249523773843678988005375000997345123572"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@f958d7b528b1b40c44cfda5eabe2d82760d868c3",
"id": "CVE-2019-11487-cb5540c4",
"target": {
"file": "include/linux/mm.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"112646549456466518504519310764232936321",
"177008728456650939073660609057625767744",
"296829282118358953251457579552910091572",
"306153521124428888643188416633809010260",
"331124523190552205519227608257404297198",
"223954166436818431784520324908532539242",
"164230098350051763528851609886022247610",
"61363267533527406460279283491066804628",
"124811251292703590085395201336249430217",
"44669774184016677722862679089953362981",
"218221785850108270105392769490857081014",
"92221142618490436285847071725366218358",
"225013139463328973060548895580410222990",
"25521458287912123219024308204989792466",
"131006553783781488749658355305607034078",
"194542317388321233224199427437659916983",
"75214840871301327509759908320128192795",
"299348174316104052387531687510899683530",
"287161725881036620712753121732136042161"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-cc79aac3",
"target": {
"file": "fs/fuse/dev.c"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"304896413003197603339568745728233696751",
"231995844580164097832689959715895416110",
"94846152640671192251595807312688022879",
"226931841014580831481268582143528600813",
"76200930663366747631900895791318923222",
"72023450653137176327671382871625930512",
"28909325118790420894156276791876548119",
"217431558059290854956610048050710088566"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-cdb67c18",
"target": {
"file": "kernel/trace/trace.c"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1085.0,
"function_hash": "171647949850267218029870762549425186404"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8fde12ca79aff9b5ba951fce1a2641901b8d8e64",
"id": "CVE-2019-11487-d559d016",
"target": {
"file": "mm/gup.c",
"function": "gup_pte_range"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"234289401672505965917450669303018270235",
"336844231457575433558916156882083078263",
"71354864596991064583289600630026775224",
"42721295921220133184961459594019950769",
"7408119908378491159284283433881850399",
"270581810766945684360488029909808799175"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-d67c5c91",
"target": {
"file": "fs/pipe.c"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 2457.0,
"function_hash": "4624733656715130150773007616159001232"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8fde12ca79aff9b5ba951fce1a2641901b8d8e64",
"id": "CVE-2019-11487-da13b36c",
"target": {
"file": "mm/gup.c",
"function": "follow_pmd_mask"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"157642036495043186221324028209907115999",
"339444470178560595769398349666469382784",
"198754936621713775474228339011969228181",
"105604716839268633141759232604543764241",
"128428911754199176260417538204737907090",
"118425890979577224512987246533833347198",
"105592671814118884422063640187137702094",
"319556204343228409918132426573557265190",
"89752638355565700196252556104278680530",
"194504126475182037439017760163874375938",
"23672394835658072805655650827094076127",
"48250352870516960647496988344489564922",
"99324318816308098417448085371284059681",
"84124977024104368485086964695920888302",
"299123226550928016557480810268859987717",
"128596123110357970739340235485327750867",
"314941796543038808463503015168829615980",
"102542011641526996739372879716601181008",
"87177184022913608177600946443617309785",
"263937384815182589952521362793093102516",
"50387536233203265296954433210774317522",
"140223654864357113296588603512058533365",
"163905781885894702905173123372321037308",
"294292675742651916249416479384455552493",
"115197740595417458650239681532573121379",
"98716222002328942956407694327753537444",
"99599175717915144432736130390506247726",
"231315895939299261399513309354412931250",
"138884562163321025937457030928477910265",
"208062964036758461727483411016177615254",
"98716222002328942956407694327753537444",
"97517120773816643899885561175958266076",
"298176596531561476269254138620460910788",
"194041669409639687117495334973153860026",
"114720384776539450902650887548674674490",
"98716222002328942956407694327753537444"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8fde12ca79aff9b5ba951fce1a2641901b8d8e64",
"id": "CVE-2019-11487-deca9204",
"target": {
"file": "mm/gup.c"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 957.0,
"function_hash": "316709461212008611917429924528905470679"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-f417eb4b",
"target": {
"file": "fs/splice.c",
"function": "link_pipe"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 786.0,
"function_hash": "279355265709221610240819093668677987788"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8fde12ca79aff9b5ba951fce1a2641901b8d8e64",
"id": "CVE-2019-11487-f5805e47",
"target": {
"file": "mm/gup.c",
"function": "gup_huge_pmd"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 2077.0,
"function_hash": "61787543743608956058448914142989690244"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8fde12ca79aff9b5ba951fce1a2641901b8d8e64",
"id": "CVE-2019-11487-fe7c426b",
"target": {
"file": "mm/gup.c",
"function": "follow_page_pte"
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-11487.json"
[
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 106.0,
"function_hash": "30922410599226035518882723147952276485"
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-2d0846a4",
"target": {
"file": "include/linux/pipe_fs_i.h",
"function": "pipe_buf_get"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 957.0,
"function_hash": "316709461212008611917429924528905470679"
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-49da7d4a",
"target": {
"file": "fs/splice.c",
"function": "link_pipe"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"199696771967834494027109219900851898140",
"302121261132131970874082410624726693754",
"294425788947633915339762799554942644554",
"154162773781904437901353005297631808314",
"230376393015780461484075442819287309278",
"175256527034700177957420911518441909183",
"218999701142339624725984770060309018353",
"287892070416892388267364692557030272316",
"282429924166075906003642118777812747972",
"157861114456579233397935545288016215206",
"60373477512358587729931053199723554415",
"33537300686045990007171153215143808432",
"316575824062744842152294326592822513312"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-6be55192",
"target": {
"file": "include/linux/pipe_fs_i.h"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"167716320382893055691744117116930563390",
"171077054328399372861042079404617335364",
"308138696364167886937849274896980667879",
"321082180923710278742974825653451392004",
"110551336440009834936557926479907332723",
"284613427836562942163017275190234622328",
"12438149221517598441977613091246411757",
"170525055582880920553488695951319401055"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-7ad509cd",
"target": {
"file": "fs/splice.c"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 120.0,
"function_hash": "283612010148318492528197249166185883708"
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-8934a2e3",
"target": {
"file": "kernel/trace/trace.c",
"function": "buffer_pipe_buf_get"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"234289401672505965917450669303018270235",
"336844231457575433558916156882083078263",
"71354864596991064583289600630026775224",
"42721295921220133184961459594019950769",
"7408119908378491159284283433881850399",
"270581810766945684360488029909808799175"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-9190f37e",
"target": {
"file": "fs/pipe.c"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"112646549456466518504519310764232936321",
"177008728456650939073660609057625767744",
"296829282118358953251457579552910091572",
"306153521124428888643188416633809010260",
"331124523190552205519227608257404297198",
"223954166436818431784520324908532539242",
"164230098350051763528851609886022247610",
"61363267533527406460279283491066804628",
"124811251292703590085395201336249430217",
"44669774184016677722862679089953362981",
"218221785850108270105392769490857081014",
"92221142618490436285847071725366218358",
"225013139463328973060548895580410222990",
"25521458287912123219024308204989792466",
"131006553783781488749658355305607034078",
"194542317388321233224199427437659916983",
"75214840871301327509759908320128192795",
"299348174316104052387531687510899683530",
"287161725881036620712753121732136042161"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-a2d91166",
"target": {
"file": "fs/fuse/dev.c"
}
},
{
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"304896413003197603339568745728233696751",
"231995844580164097832689959715895416110",
"94846152640671192251595807312688022879",
"226931841014580831481268582143528600813",
"76200930663366747631900895791318923222",
"72023450653137176327671382871625930512",
"28909325118790420894156276791876548119",
"217431558059290854956610048050710088566"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-bcb185c5",
"target": {
"file": "kernel/trace/trace.c"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1405.0,
"function_hash": "230235247948162646073791680223882320773"
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-cd003735",
"target": {
"file": "fs/splice.c",
"function": "splice_pipe_to_pipe"
}
},
{
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 1596.0,
"function_hash": "188137618908441444825684155206012870081"
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb",
"id": "CVE-2019-11487-dcf87baf",
"target": {
"file": "fs/fuse/dev.c",
"function": "fuse_dev_splice_write"
}
}
]