CVE-2019-5023: An exploitable vulnerability exists in the grsecurity PaX patch for the function read_kmem, in PaX from versio

This week

MEDIUM 5.9REMOTEUPGRADEUPGRADE

CVE-2019-5023 is a medium-severity flaw (CVSS 5.9) affecting grsecurity, pax. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An exploitable vulnerability exists in the grsecurity PaX patch for the function read_kmem, in PaX from version pax-linux-4.9.8-test1 to 4.9.24-test7, grsecurity official from version grsecurity-3.1-4.9.8-201702060653 to grsecurity-3.1-4.9.24-201704252333, grsecurity unofficial from version v4.9.25-unofficialgrsec to v4.9.74-unofficialgrsec. PaX adds a temp buffer to the read_kmem function, which is never freed when an invalid address is supplied

Why this priority

Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	5.9 (Medium)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	None
User interaction	None
EPSS exploit chance	0.7% (top 45%)
CISA exploited list	No
Weakness	CWE-401, CWE-772
Published	2019-10-31
Last modified	2026-06-17

Publisher (CNA): Talos · Vendor: opensrcsec

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-10-31 21:15 UTCPublished CVE record published
2026-06-17 02:37 UTCUpdated Record last modified

opensrcsec grsecurity UPGRADE

Affected: >= 3.1-4.9.8-201702060653 and <= 3.1-4.9.24-201704252333 · >= 4.9.25 and <= 4.9.74

Fixed in: newer than 4.9.74

Safe to downgrade to: a release before 3.1-4.9.8-201702060653

1. Check installed version

apt-cache policy grsecurity || rpm -q grsecurity || grsecurity --version

2. UPGRADE to newer than 4.9.74 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade grsecurity

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade grsecurity

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 3.1-4.9.8-201702060653 (Debian / Ubuntu)

apt-cache madison grsecurity sudo apt install grsecurity=<VERSION_BEFORE_3.1-4.9.8-201702060653> sudo apt-mark hold grsecurity

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list grsecurity sudo dnf downgrade grsecurity-<VERSION_BEFORE_3.1-4.9.8-201702060653> sudo dnf versionlock add grsecurity

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

opensrcsec pax UPGRADE

Affected: >= pax-linux-4.9.8-test1 and <= pax-linux-4.9.8-test7

Fixed in: newer than pax-linux-4.9.8-test7

Safe to downgrade to: a release before pax-linux-4.9.8-test1

1. Check installed version

apt-cache policy pax || rpm -q pax || pax --version

2. UPGRADE to newer than pax-linux-4.9.8-test7 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade pax

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade pax

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before pax-linux-4.9.8-test1 (Debian / Ubuntu)

apt-cache madison pax sudo apt install pax=<VERSION_BEFORE_pax-linux-4.9.8-test1> sudo apt-mark hold pax

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list pax sudo dnf downgrade pax-<VERSION_BEFORE_pax-linux-4.9.8-test1> sudo dnf versionlock add pax

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-5023?

grsecurity: upgrade to newer than 4.9.74; pax: upgrade to newer than pax-linux-4.9.8-test7. Exact commands for each OS are on this page.

Is CVE-2019-5023 being exploited?

CVE-2019-5023 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-5023 affect?

CVE-2019-5023 affects grsecurity, pax. Severity is medium (CVSS 5.9). An exploitable vulnerability exists in the grsecurity PaX patch for the function read_kmem, in PaX from version pax-linux-4.9.8-test1 to 4.9.24-test7, grsecurity official from version grsecurity-3.1-4.9.8-201702060653 to grsecurity-3.1-4.9.

How urgent is CVE-2019-5023?

Priority 44/100. Public exploit reference; Remotely exploitable, no login, no user action

References

← Back to latest CVEs