TI-2019-14547 Aliases CVE-2019-20172 GHSA-rf88-p934-8hgp

Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with…

LOW 35CWE-119Published 2019-12-31 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack.

Why it matters now

EPSS 0.00475 41st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:serenityos:serenityos::::::::	before 2019-12-30	Vulnerable	Serenityos

cpe:2.3:o:serenityos:serenityos:*:*:*:*:*:*:*:* Versions before 2019-12-30 Vulnerable ·Serenityos

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-20172
2026-10-03 Alias added: GHSA-rf88-p934-8hgp

References

Exploit 1

https://github.com/Fire30/CTF-WRITEUPS/tree/master/36c3_ctf/wisdom

Patch 1

https://github.com/SerenityOS/serenity/commit/0fc24fe2564736689859e7edfa177a86dac36bf9

TI-2021-11461 SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory… CVSS 3.1CRITICAL 9.8
TI-2021-03185 SerenityOS TypedArray.cpp initialize_typed_array_from_array_buffer integer overflow CVSS 3.1CRITICAL 9.8
TI-2021-10634 SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function. CVSS 3.1CRITICAL 9.1
TI-2021-09844 SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer… CVSS 3.1HIGH 7.8
TI-2021-08849 SerenityOS Unspecified is affected by: Buffer Overflow. CVSS 3.1HIGH 7.5
TI-2021-12737 SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow… CVSS 3.1HIGH 7.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences