exploitDog

CVE-2019-3900

Опубликовано: 25 апр. 2019

Источник: nvd

CVSS3: 6.3

CVSS3: 7.7

CVSS2: 6.8

EPSS Низкий

Описание

An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.

Ссылки

http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
Patch
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/108076
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:1973
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2029
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2043
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3220
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3309
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3517
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3836
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3967
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4058
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0204
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3900
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYTZH6QCNITK7353S6RCRT2PQHZSDPXD/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RI3WXXM5URTZSR3RVEKO6MDXDFIKTZ5R/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOFNJA5NNVXQ6AV6KGZB677JIVXAMJHT/
Mailing List
https://seclists.org/bugtraq/2019/Aug/18
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Nov/11
Mailing List
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 2.6.34 (включая) до 3.16.72 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 3.17 (включая) до 4.4.191 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.5 (включая) до 4.9.190 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.10 (включая) до 4.14.133 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.15 (включая) до 4.19.64 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.20 (включая) до 5.2 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager_for_vmware_vsphere:*:*:*:*:*:*:*:*

Версия от 9.5 (включая)

cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap_for_vmware_vsphere:*:*:*:*:*:*:*:*

Версия от 7.2 (включая)

cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*

Версия от 7.2 (включая)

cpe:2.3:a:netapp:virtual_storage_console_for_vmware_vsphere:*:*:*:*:*:*:*:*

Версия от 7.2 (включая)

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:*

Конфигурация 8

cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*

Конфигурация 9

Одно из

cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

EPSS

Процентиль: 32%

0.00118

Низкий

6.3 Medium

CVSS3

7.7 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-835

CWE-835

Связанные уязвимости

CVE-2019-3900

CVSS3: 7.7

ubuntu

около 6 лет назад

An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.

CVE-2019-3900

CVSS3: 6.3

redhat

около 6 лет назад

An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.

CVE-2019-3900

CVSS3: 7.7

debian

около 6 лет назад

An infinite loop issue was found in the vhost_net kernel module in Lin ...

GHSA-h25g-v6rp-rj4h

CVSS3: 7.7

github

около 3 лет назад

An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.

BDU:2019-03630

CVSS3: 6.5

fstec

около 6 лет назад

Уязвимость модуля vhost_net ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 32%

0.00118

Низкий

6.3 Medium

CVSS3

7.7 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-835

CWE-835