Memory leak in Linux kernel - CVE-2019-19072

Vulnerability identifier: #VU23034

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19072

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the "predicate_parse()" function in "kernel/trace/trace_events_filter.c" file. A local attacker can cause a denial of service (memory consumption).

Linux kernel
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Fedora
kernel (Red Hat package)
kernel

Install update from vendor's website.

Linux kernel - update to 5.3.12
kernel (Red Hat package) - update to 4.18.0-240.el8
kernel - addressed in versions 5.3.12-200.fc30, 5.3.12-300.fc31

• https://github.com/torvalds/linux/commit/96c5c6e6a5b6db592acae039fed54b5c8844cd35
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T/

• Multiple vulnerabilities in Linux kernel
• Red Hat Enterprise Linux 8 update for kernel
• Fedora 31 update for kernel
• Fedora 30 update for kernel