CVE-2019-6974

Source
Severity High
Remote No
Type Arbitrary code execution
Description
A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvm_ioctl_create_device(), the device holds a reference to a VM object, later this reference is transferred to the caller's file descriptor table. If such file descriptor was to be closed, reference count to the VM object could become zero, potentially leading to a use-after-free issue. A user/process could use this flaw to crash the guest VM resulting in a denial of service issue or, potentially, gain privileged access to a system.
Group Package Affected Fixed Severity Status Ticket
AVG-850 linux 4.20.arch1-1 Critical Vulnerable
References
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cfa39381173d5f969daf43582c95ad679189cbc9
https://bugs.chromium.org/p/project-zero/issues/detail?id=1765
https://www.exploit-db.com/exploits/46388