Security tracker / CVE-2019-20794

CVE-2019-20794

fuse: FUSE daemon can make itself unkillable with request loops

References

• Debian security tracker
• cve.org
• https://github.com/sargun/fuse-example
• https://sourceforge.net/p/fuse/mailman/message/36598753/
• https://lore.kernel.org/lkml/1e796f9e008fb78fb96358ff74f39bd4865a7c88.1604926010.git.gladkov.alexey@gmail.com/

Notes

 bwh> The proposed fix notes that the daemon can be killed off through
 bwh> the fusectl filesystem, but the kill command or service shutdown
 bwh> won't work.

Bugs

Status

Branch	Status
upstream	needed
6.18-upstream-stable
6.17-upstream-stable
6.12-upstream-stable
6.6-upstream-stable
6.1-upstream-stable	needed
5.10-upstream-stable	needed
4.9-upstream-stable	ignored "EOL"
3.16-upstream-stable	ignored "EOL"
sid	needed
6.12-trixie-security	needed
6.1-bookworm-security	needed
5.10-bullseye-security	needed
4.9-stretch-security	ignored "EOL"
3.16-jessie-security	ignored "EOL"