Memory leak in Linux kernel - CVE-2019-19058
Published: November 27, 2019 / Updated: December 5, 2019
Vulnerability identifier: #VU23024
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-19058
CWE-ID: CWE-401
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the "alloc_sgtable()" function in "drivers/net/wireless/intel/iwlwifi/fw/dbg.c" file. A remote attacker on the local network can cause a denial of service (memory consumption) by triggering "alloc_page()" failures.
Affected software
Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Workstation
Fedora
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Workstation
Fedora
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel
How to mitigate CVE-2019-19058
Install update from vendor's website.
Linux kernel - update to 5.3.12
kernel (Red Hat package) - update to 3.10.0-1160.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.rt56.1131.el7
kernel - addressed in versions 5.3.12-200.fc30, 5.3.12-300.fc31
kernel (Red Hat package) - update to 3.10.0-1160.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.rt56.1131.el7
kernel - addressed in versions 5.3.12-200.fc30, 5.3.12-300.fc31
External References
- https://github.com/torvalds/linux/commit/b4b814fec1a5a849383f7b3886b654a13abbda7d
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T/