What is the CVSS score of CVE-2019-5094?

CVE-2019-5094 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Is there a public PoC exploit available for CVE-2019-5094?

Yes, a public proof-of-concept exploit is available for CVE-2019-5094. Prioritise patching immediately. EPSS: 1.1%.

E2Fsprogs CVE-2019-5094

HIGH

Out-of-bounds Write (CWE-787)

2019-09-24 talos-cna@cisco.com

Buffer Overflow RCE Memory Corruption E2Fsprogs Debian Linux Fedora Ubuntu Linux Hci Management Node Solidfire

7.5

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (cisco) · only source for this CVE.

CVSS VectorVendor: cisco

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Sep 24, 2019 - 22:15 cve.org

HIGH 7.5

DescriptionCVE.org

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

AnalysisAI

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. Rated high severity (CVSS 7.5). Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Write (CWE-787), which allows attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. Affected products include: E2Fsprogs Project E2Fsprogs, Debian Debian Linux, Fedoraproject Fedora, Canonical Ubuntu Linux, Netapp Hci Management Node.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate write boundaries, use memory-safe languages, enable compiler protections (ASLR, stack canaries).