CVE-2019-14821

EPSS 0.76%
Veröffentlicht 19.09.2019 18:15:10
Zuletzt bearbeitet 21.11.2024 04:27:25
Erkennungen
Login

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 32

NVD 50 VulnDex Vulnerability Enrichment 10

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linux ≫ Linux Kernel Version >= 2.6.27 <= 3.15.10

Linux ≫ Linux Kernel Version >= 3.16 < 3.16.74

Linux ≫ Linux Kernel Version >= 4.4 < 4.4.194

Linux ≫ Linux Kernel Version >= 4.9 < 4.9.194

Linux ≫ Linux Kernel Version >= 4.14 < 4.14.146

Linux ≫ Linux Kernel Version >= 4.19 < 4.19.75

Linux ≫ Linux Kernel Version >= 5.2 < 5.2.17

Linux ≫ Linux Kernel Version >= 5.3 < 5.3.1

Linux ≫ Linux Kernel Version 5.4 Update rc1

Redhat ≫ Virtualization Host Version 4.0

Redhat ≫ Enterprise Linux Version 8.0

Redhat ≫ Enterprise Linux Desktop Version 6.0

Redhat ≫ Enterprise Linux Desktop Version 7.0

Redhat ≫ Enterprise Linux Eus Version 7.7

Redhat ≫ Enterprise Linux For Real Time Version 7

Redhat ≫ Enterprise Linux For Real Time Version 8

Redhat ≫ Enterprise Linux Server Version 6.0

Redhat ≫ Enterprise Linux Server Version 7.0

Redhat ≫ Enterprise Linux Server Aus Version 7.7

Redhat ≫ Enterprise Linux Server Tus Version 7.7

Redhat ≫ Enterprise Linux Workstation Version 6.0

Redhat ≫ Enterprise Linux Workstation Version 7.0

Canonical ≫ Ubuntu Linux Version 14.04 SwEdition esm

Canonical ≫ Ubuntu Linux Version 16.04 SwEdition esm

Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts

Canonical ≫ Ubuntu Linux Version 19.04

Opensuse ≫ Leap Version 15.0

Opensuse ≫ Leap Version 15.1

Fedoraproject ≫ Fedora Version 29

Fedoraproject ≫ Fedora Version 30

Debian ≫ Debian Linux Version 8.0

Debian ≫ Debian Linux Version 9.0

Debian ≫ Debian Linux Version 10.0

Netapp ≫ Aff A700s Firmware Version -

Netapp ≫ Aff A700s Version -

Netapp ≫ H300s Firmware Version -

Netapp ≫ H300s Version -

Netapp ≫ H500s Firmware Version -

Netapp ≫ H500s Version -

Netapp ≫ H700s Firmware Version -

Netapp ≫ H700s Version -

Netapp ≫ H300e Firmware Version -

Netapp ≫ H300e Version -

Netapp ≫ H500e Firmware Version -

Netapp ≫ H500e Version -

Netapp ≫ H700e Firmware Version -

Netapp ≫ H700e Version -

Netapp ≫ H410s Firmware Version -

Netapp ≫ H410s Version -

Netapp ≫ H410c Firmware Version -

Netapp ≫ H410c Version -

Netapp ≫ H610s Firmware Version -

Netapp ≫ H610s Version -

Netapp ≫ Data Availability Services Version -

Netapp ≫ Hci Management Node Version -

Netapp ≫ Solidfire Version -

Oracle ≫ Sd-wan Edge Version 7.3

Oracle ≫ Sd-wan Edge Version 8.0

Oracle ≫ Sd-wan Edge Version 8.1

Oracle ≫ Sd-wan Edge Version 8.2

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.76%	0.505

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.8	2	6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NIST	7.2	3.9	10	AV:L/AC:L/Au:N/C:C/I:C/A:C
RedHat	7.5	1.1	5.8	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://www.oracle.com/security-alerts/cpuapr2020.html

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3517

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:4154

Third Party Advisory

https://usn.ubuntu.com/4163-1/

Third Party Advisory

https://usn.ubuntu.com/4163-2/

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3309

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0204

Third Party Advisory

http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

Third Party Advisory

VDB Entry

https://seclists.org/bugtraq/2019/Nov/11

Third Party Advisory

Mailing List

http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html

Third Party Advisory

VDB Entry

https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html

Third Party Advisory

Mailing List

https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html

Third Party Advisory

Mailing List

https://seclists.org/bugtraq/2019/Sep/41

Third Party Advisory

Mailing List

Issue Tracking

https://usn.ubuntu.com/4162-1/

Third Party Advisory

https://usn.ubuntu.com/4162-2/

Third Party Advisory

https://www.debian.org/security/2019/dsa-4531

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3978

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3979

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0027

Third Party Advisory

https://usn.ubuntu.com/4157-1/

Third Party Advisory

https://usn.ubuntu.com/4157-2/

Third Party Advisory

https://security.netapp.com/advisory/ntap-20191004-0001/

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/

Third Party Advisory

Mailing List

http://www.openwall.com/lists/oss-security/2019/09/20/1

Patch

Third Party Advisory

Mailing List

https://access.redhat.com/errata/RHSA-2019:4256

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14821

Patch

Third Party Advisory

Issue Tracking

Mitigation

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZQQQANZWQMPILZV7OTS3RGGRLLE2Q7/

Third Party Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2019-14821

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-14821

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-14821

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-14821