CVE-2019-19725
📋 TL;DR
CVE-2019-19725 is a double-free vulnerability in sysstat's sa_common.c that allows memory corruption. Attackers can exploit this to potentially execute arbitrary code or cause denial of service. Systems running sysstat versions through 12.2.0 are affected.
💻 Affected Systems
- sysstat
📦 What is this software?
Sysstat by Sysstat Project
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges leading to complete system compromise
Likely Case
Denial of service through application crash or local privilege escalation
If Mitigated
Limited impact if sysstat runs with minimal privileges and memory protections are enabled
🎯 Exploit Status
Exploitation requires local access to trigger the double-free condition
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.2.1 and later
Vendor Advisory: https://github.com/sysstat/sysstat/issues/242
Restart Required: No
Instructions:
1. Update sysstat package using your distribution's package manager
2. For Debian/Ubuntu: sudo apt update && sudo apt install sysstat
3. For RHEL/CentOS: sudo yum update sysstat
4. For source installation: Download and compile version 12.2.1+ from sysstat GitHub
🔧 Temporary Workarounds
Disable sysstat data collection
linuxStop sysstat from collecting and processing activity files
sudo systemctl stop sysstat
sudo systemctl disable sysstat
Remove vulnerable binary
linuxTemporarily remove or restrict access to vulnerable sysstat binaries
sudo chmod 000 /usr/lib/sysstat/sa_common
sudo mv /usr/lib/sysstat/sa_common /usr/lib/sysstat/sa_common.bak
🧯 If You Can't Patch
- Run sysstat with reduced privileges using SELinux/AppArmor
- Implement strict access controls to limit who can execute sysstat commands
🔍 How to Verify
Check if Vulnerable:
Check sysstat version: sadc -V | grep 'sysstat version'Check Version:
sadc -V | grep 'sysstat version' || sysstat --versionVerify Fix Applied:
Verify version is 12.2.1 or higher: sadc -V | grep 'sysstat version'📡 Detection & Monitoring
Log Indicators:
- Segmentation faults in sysstat processes
- Abnormal memory usage patterns in sysstat
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
process.name:sadc AND event.outcome:failure OR process.name:sadc AND event.severity:critical🔗 References
- https://github.com/sysstat/sysstat/issues/242
- https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html
- https://security.gentoo.org/glsa/202007-22
- https://usn.ubuntu.com/4242-1/
- https://github.com/sysstat/sysstat/issues/242
- https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html
- https://security.gentoo.org/glsa/202007-22
- https://usn.ubuntu.com/4242-1/
