Infinite loop in Linux kernel - CVE-2019-3900

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU19998

Infinite loop in Linux kernel - CVE-2019-3900

Published: August 8, 2019 / Updated: May 30, 2020


Vulnerability identifier: #VU19998
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-3900
CWE-ID: CWE-835
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in vhost_net kernel module when processing incoming packets in handle_rx(). A remote attacker with access to guest operating system can stall the vhost_net kernel thread and cause denial of service conditions.


Affected software

Linux kernel
Amazon Linux AMI
SUSE CaaS Platform
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Virtualization Host - Extended Update Support 4.2 for RHEL
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Live Patching
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Real Time Extension
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Live Patching
Fedora

kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-alt (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
kernel-livepatch-4_12_14-150_78-default-debuginfo
kernel-livepatch-4_12_14-150_78-default
kernel-livepatch-4_12_14-197_102-default
kgraft-patch-4_12_14-95_83-default
kgraft-patch-4_12_14-122_88-default
kernel-default
kernel-syms
kernel-default-base
kernel-default-devel
kernel-ec2
kernel-ec2-base
kernel-ec2-devel
kernel-source
kernel-trace
kernel-trace-base
kernel-trace-devel
kernel-xen
kernel-xen-base
kernel-xen-devel
kernel-default-debugsource
kernel-default-base-debuginfo
kernel-macros
kernel-devel
kernel-default-debuginfo
linux-4.4.199/kernel-modules
linux-4.4.199/kernel-huge
linux-4.4.199/kernel-generic
linux-4.4.199/kernel-headers
kernel-devel-rt
kernel-syms-rt
kernel-source-rt
kernel-rt-debugsource
cluster-md-kmp-rt
cluster-md-kmp-rt-debuginfo
dlm-kmp-rt
dlm-kmp-rt-debuginfo
gfs2-kmp-rt
gfs2-kmp-rt-debuginfo
kernel-rt
kernel-rt-base
kernel-rt-base-debuginfo
kernel-rt-debuginfo
kernel-rt-devel
kernel-rt-devel-debuginfo
kernel-rt_debug
kernel-rt_debug-debuginfo
kernel-rt_debug-debugsource
kernel-rt_debug-devel
kernel-rt_debug-devel-debuginfo
ocfs2-kmp-rt-debuginfo
ocfs2-kmp-rt
kernel-devel-azure
kernel-source-azure
kernel-syms-azure
kernel-azure
kernel-azure-base
kernel-azure-base-debuginfo
kernel-azure-debuginfo
kernel-azure-debugsource
kernel-azure-devel
cluster-md-kmp-default-debuginfo
ocfs2-kmp-default-debuginfo
ocfs2-kmp-default
gfs2-kmp-default-debuginfo
gfs2-kmp-default
dlm-kmp-default-debuginfo
dlm-kmp-default
cluster-md-kmp-default
kernel-default-kgraft-devel
kernel-default-kgraft
kernel-default-man
kernel-default-devel-debuginfo
kernel-default-extra
kernel-docs
kernel-default-extra-debuginfo
kernel-obs-build-debugsource
kernel-obs-build
kernel-zfcpdump-debugsource
kernel-vanilla-debugsource
reiserfs-kmp-default
reiserfs-kmp-default-debuginfo
kernel-zfcpdump-debuginfo
kernel-default-livepatch
kernel-vanilla-base-debuginfo
kernel-vanilla-base
kernel-vanilla-debuginfo
kernel-default-livepatch-devel
kernel
Red Hat Virtualization Host
Oracle SD-WAN Edge

How to mitigate CVE-2019-3900

Install updates from vendor's website.

Linux kernel - addressed in versions 4.4.191, 4.9.190, 4.14.133, 4.19.64, 5.2
kernel (Red Hat package) - addressed in versions 2.6.32-754.24.2.el6, 3.10.0-693.61.1.el7, 3.10.0-862.44.2.el7, 3.10.0-957.38.1.el7, 3.10.0-1062.el7, 4.18.0-80.15.1.el8_0
kernel-rt (Red Hat package) - addressed in versions 3.10.0-1062.rt56.1022.el7, 4.18.0-147.rt24.93.el8
kernel-alt (Red Hat package) - update to 4.14.0-115.10.1.el7a
kernel-livepatch-4_12_14-150_78-default-debuginfo - update to 1-1.3.1
kernel-livepatch-4_12_14-150_78-default - update to 1-1.3.1
kernel-livepatch-4_12_14-197_102-default - update to 1-3.3.1
kgraft-patch-4_12_14-95_83-default - update to 1-6.3.1
kgraft-patch-4_12_14-122_88-default - update to 1-8.5.1
kernel-default - addressed in versions 3.0.101-108.138.1, 4.4.121-92.188.1, 4.4.180-94.174.1, 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-syms - addressed in versions 3.0.101-108.138.1, 4.4.121-92.188.1, 4.4.180-94.174.1, 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-default-base - addressed in versions 3.0.101-108.138.1, 4.4.121-92.188.1, 4.4.180-94.174.1, 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-default-devel - addressed in versions 3.0.101-108.138.1, 4.4.121-92.188.1, 4.4.180-94.174.1, 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-ec2 - update to 3.0.101-108.138.1
kernel-ec2-base - update to 3.0.101-108.138.1
kernel-ec2-devel - update to 3.0.101-108.138.1
kernel-source - addressed in versions 3.0.101-108.138.1, 4.4.121-92.188.1, 4.4.180-94.174.1, 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-trace - update to 3.0.101-108.138.1
kernel-trace-base - update to 3.0.101-108.138.1
kernel-trace-devel - update to 3.0.101-108.138.1
kernel-xen - update to 3.0.101-108.138.1
kernel-xen-base - update to 3.0.101-108.138.1
kernel-xen-devel - update to 3.0.101-108.138.1
kernel-default-debugsource - addressed in versions 4.4.121-92.188.1, 4.4.180-94.174.1, 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-default-base-debuginfo - addressed in versions 4.4.121-92.188.1, 4.4.180-94.174.1, 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-197.102.2
kernel-macros - addressed in versions 4.4.121-92.188.1, 4.4.180-94.174.1, 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-devel - addressed in versions 4.4.121-92.188.1, 4.4.180-94.174.1, 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-default-debuginfo - addressed in versions 4.4.121-92.188.1, 4.4.180-94.174.1, 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
linux-4.4.199/kernel-modules - update to 4.4.199
linux-4.4.199/kernel-huge - update to 4.4.199
linux-4.4.199/kernel-generic - update to 4.4.199
linux-4.4.199/kernel-headers - update to 4.4.199_smp
kernel-devel-rt - update to 4.12.14-10.57.1
kernel-syms-rt - update to 4.12.14-10.57.1
kernel-source-rt - update to 4.12.14-10.57.1
kernel-rt-debugsource - update to 4.12.14-10.57.2
cluster-md-kmp-rt - update to 4.12.14-10.57.2
cluster-md-kmp-rt-debuginfo - update to 4.12.14-10.57.2
dlm-kmp-rt - update to 4.12.14-10.57.2
dlm-kmp-rt-debuginfo - update to 4.12.14-10.57.2
gfs2-kmp-rt - update to 4.12.14-10.57.2
gfs2-kmp-rt-debuginfo - update to 4.12.14-10.57.2
kernel-rt - update to 4.12.14-10.57.2
kernel-rt-base - update to 4.12.14-10.57.2
kernel-rt-base-debuginfo - update to 4.12.14-10.57.2
kernel-rt-debuginfo - update to 4.12.14-10.57.2
kernel-rt-devel - update to 4.12.14-10.57.2
kernel-rt-devel-debuginfo - update to 4.12.14-10.57.2
kernel-rt_debug - update to 4.12.14-10.57.2
kernel-rt_debug-debuginfo - update to 4.12.14-10.57.2
kernel-rt_debug-debugsource - update to 4.12.14-10.57.2
kernel-rt_debug-devel - update to 4.12.14-10.57.2
kernel-rt_debug-devel-debuginfo - update to 4.12.14-10.57.2
ocfs2-kmp-rt-debuginfo - update to 4.12.14-10.57.2
ocfs2-kmp-rt - update to 4.12.14-10.57.2
kernel-devel-azure - update to 4.12.14-16.73.1
kernel-source-azure - update to 4.12.14-16.73.1
kernel-syms-azure - update to 4.12.14-16.73.1
kernel-azure - update to 4.12.14-16.73.2
kernel-azure-base - update to 4.12.14-16.73.2
kernel-azure-base-debuginfo - update to 4.12.14-16.73.2
kernel-azure-debuginfo - update to 4.12.14-16.73.2
kernel-azure-debugsource - update to 4.12.14-16.73.2
kernel-azure-devel - update to 4.12.14-16.73.2
cluster-md-kmp-default-debuginfo - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
ocfs2-kmp-default-debuginfo - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
ocfs2-kmp-default - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
gfs2-kmp-default-debuginfo - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
gfs2-kmp-default - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
dlm-kmp-default-debuginfo - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
dlm-kmp-default - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
cluster-md-kmp-default - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-default-kgraft-devel - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1
kernel-default-kgraft - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1
kernel-default-man - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-default-devel-debuginfo - addressed in versions 4.12.14-95.83.2, 4.12.14-122.88.1, 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-default-extra - update to 4.12.14-122.88.1
kernel-docs - addressed in versions 4.12.14-122.88.1, 4.12.14-150.78.2, 4.12.14-197.102.2
kernel-default-extra-debuginfo - update to 4.12.14-122.88.1
kernel-obs-build-debugsource - addressed in versions 4.12.14-122.88.2, 4.12.14-150.78.2, 4.12.14-197.102.1
kernel-obs-build - addressed in versions 4.12.14-122.88.2, 4.12.14-150.78.2, 4.12.14-197.102.1
kernel-zfcpdump-debugsource - addressed in versions 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-vanilla-debugsource - update to 4.12.14-150.78.1
reiserfs-kmp-default - addressed in versions 4.12.14-150.78.1, 4.12.14-197.102.2
reiserfs-kmp-default-debuginfo - addressed in versions 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-zfcpdump-debuginfo - addressed in versions 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-default-livepatch - addressed in versions 4.12.14-150.78.1, 4.12.14-197.102.2
kernel-vanilla-base-debuginfo - update to 4.12.14-150.78.1
kernel-vanilla-base - update to 4.12.14-150.78.1
kernel-vanilla-debuginfo - update to 4.12.14-150.78.1
kernel-default-livepatch-devel - update to 4.12.14-197.102.2
kernel - update to 5.0.10-300.fc30

External References

Related Security Bulletins