9.3

CVE-2019-11815

Exploit
An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.3 < 4.4.179
Linux ≫ Linux Kernel Version >= 4.9 < 4.9.169
Linux ≫ Linux Kernel Version >= 4.14 < 4.14.112
Linux ≫ Linux Kernel Version >= 4.19 < 4.19.35
Linux ≫ Linux Kernel Version >= 5.0 < 5.0.8
Linux ≫ Linux Kernel Version 5.1 Update rc1
Linux ≫ Linux Kernel Version 5.1 Update rc2
Linux ≫ Linux Kernel Version 5.1 Update rc3
Linux ≫ Linux Kernel Version 5.1 Update rc4
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 19.04
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Opensuse ≫ Leap Version 15.0
Opensuse ≫ Leap Version 15.1
Opensuse ≫ Leap Version 42.3
Netapp ≫ Active Iq Unified Manager SwPlatform vmware_vsphere Version >= 9.5
Netapp ≫ Hci Management Node Version -
Netapp ≫ Snapprotect Version -
Netapp ≫ Solidfire Version -
Netapp ≫ Storage Replication Adapter Version 7.2 SwPlatform vsphere
Netapp ≫ Virtual Storage Console SwPlatform vsphere Version >= 7.2
Netapp ≫ Hci Compute Node Version -
Netapp ≫ Hci Storage Node Version -
Netapp ≫ Cn1610 Firmware Version -
   Netapp ≫ Cn1610 Version -
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.46% 0.902
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://packetstormsecurity.com/files/153799/Kernel-Live-Patch-Security-Notice-LSN-0053-1.html
Third Party Advisory
VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/4118-1/
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html
Third Party Advisory
Mailing List
https://seclists.org/bugtraq/2019/Jun/26
Third Party Advisory
Mailing List
Issue Tracking
https://www.debian.org/security/2019/dsa-4465
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/4008-1/
Third Party Advisory
https://usn.ubuntu.com/4008-3/
Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8
Vendor Advisory
Release Notes
https://security.netapp.com/advisory/ntap-20190719-0003/
Third Party Advisory
https://usn.ubuntu.com/4005-1/
Third Party Advisory
http://www.securityfocus.com/bid/108283
Third Party Advisory
VDB Entry
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb66ddd156203daefb8d71158036b27b0e2caf63
Patch
Vendor Advisory
Exploit
https://github.com/torvalds/linux/commit/cb66ddd156203daefb8d71158036b27b0e2caf63
Patch
Third Party Advisory
Exploit
https://support.f5.com/csp/article/K32019083
Third Party Advisory
https://usn.ubuntu.com/4068-1/
Third Party Advisory
https://usn.ubuntu.com/4068-2/
Third Party Advisory