Information disclosure in Linux kernel - CVE-2019-10638

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU19186

Information disclosure in Linux kernel - CVE-2019-10638

Published: July 15, 2019 / Updated: July 18, 2019


Vulnerability identifier: #VU19186
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-10638
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the software uses the IP ID values that the kernel produces for connectionless protocols. A remote attacker with a crafted web page can forge the targeted system to send UDP traffic to an attacker-controlled IP address to gain unauthorized access to sensitive information on the system.


Affected software

Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Slackware Linux
Opensuse
linux-4.4.199/kernel-generic
linux-4.4.199/kernel-huge
linux-4.4.199/kernel-modules
linux-4.4.199/kernel-headers
kernel-rt (Red Hat package)

How to mitigate CVE-2019-10638

Install updates from vendor's website.

Linux kernel - addressed in versions 5.0.8, 5.1.7
linux-4.4.199/kernel-generic - update to 4.4.199
linux-4.4.199/kernel-huge - update to 4.4.199
linux-4.4.199/kernel-modules - update to 4.4.199
linux-4.4.199/kernel-headers - update to 4.4.199_smp
kernel-rt (Red Hat package) - update to 4.18.0-147.rt24.93.el8

External References

Related Security Bulletins