Memory leak in Linux kernel - CVE-2019-19045
Published: November 18, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30602
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-19045
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_vector2eqn() failures, aka CID-c8c2a057fdc7. A remote attacker can perform a denial of service attack.
Affected software
Linux kernel
Ubuntu
linux-kvm (Ubuntu package)
linux-snapdragon (Ubuntu package)
linux-hwe (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux (Ubuntu package)
linux-raspi2 (Ubuntu package)
linux-oem (Ubuntu package)
linux-aws (Ubuntu package)
linux-oracle (Ubuntu package)
linux-gke-4.15 (Ubuntu package)
linux-aws-hwe (Ubuntu package)
Ubuntu
linux-kvm (Ubuntu package)
linux-snapdragon (Ubuntu package)
linux-hwe (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux (Ubuntu package)
linux-raspi2 (Ubuntu package)
linux-oem (Ubuntu package)
linux-aws (Ubuntu package)
linux-oracle (Ubuntu package)
linux-gke-4.15 (Ubuntu package)
linux-aws-hwe (Ubuntu package)
How to mitigate CVE-2019-19045
Update to version 5.3.11.
Linux kernel - update to 5.3.11
linux-kvm (Ubuntu package) - update to 4.15.0-1052.52
linux-snapdragon (Ubuntu package) - update to 4.15.0-1070.77
linux-hwe (Ubuntu package) - update to 4.15.0-74.83~16.04.1
linux-gcp (Ubuntu package) - update to 4.15.0-1052.56
linux-azure (Ubuntu package) - update to 4.15.0-1066.71
linux (Ubuntu package) - update to 4.15.0-74.84
linux-raspi2 (Ubuntu package) - update to 4.15.0-1053.57
linux-oem (Ubuntu package) - update to 4.15.0-1066.76
linux-aws (Ubuntu package) - update to 4.15.0-1057.59
linux-oracle (Ubuntu package) - addressed in versions 4.15.0-1031.34~16.04.1, 4.15.0-1031.34
linux-gke-4.15 (Ubuntu package) - update to 4.15.0-1050.53
linux-aws-hwe (Ubuntu package) - update to 4.15.0-1057.59~16.04.1
linux-kvm (Ubuntu package) - update to 4.15.0-1052.52
linux-snapdragon (Ubuntu package) - update to 4.15.0-1070.77
linux-hwe (Ubuntu package) - update to 4.15.0-74.83~16.04.1
linux-gcp (Ubuntu package) - update to 4.15.0-1052.56
linux-azure (Ubuntu package) - update to 4.15.0-1066.71
linux (Ubuntu package) - update to 4.15.0-74.84
linux-raspi2 (Ubuntu package) - update to 4.15.0-1053.57
linux-oem (Ubuntu package) - update to 4.15.0-1066.76
linux-aws (Ubuntu package) - update to 4.15.0-1057.59
linux-oracle (Ubuntu package) - addressed in versions 4.15.0-1031.34~16.04.1, 4.15.0-1031.34
linux-gke-4.15 (Ubuntu package) - update to 4.15.0-1050.53
linux-aws-hwe (Ubuntu package) - update to 4.15.0-1057.59~16.04.1
External References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11
- https://github.com/torvalds/linux/commit/c8c2a057fdc7de1cd16f4baa51425b932a42eb39
- https://security.netapp.com/advisory/ntap-20191205-0001/
- https://usn.ubuntu.com/4225-1/
- https://usn.ubuntu.com/4225-2/
- https://usn.ubuntu.com/4226-1/
- https://usn.ubuntu.com/4227-1/
- https://usn.ubuntu.com/4227-2/