CVEvulnerability
CVE-2019-14821
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-09-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-787
Description
An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.
Affected configurations
• linux linux kernel (>= 2.6.27 <= 3.15.10)
• linux linux kernel (>= 3.16 < 3.16.74)
• linux linux kernel (>= 4.4 < 4.4.194)
• linux linux kernel (>= 4.9 < 4.9.194)
• linux linux kernel (>= 4.14 < 4.14.146)
• linux linux kernel (>= 4.19 < 4.19.75)
• linux linux kernel (>= 5.2 < 5.2.17)
• linux linux kernel (>= 5.3 < 5.3.1)
• linux linux kernel 5.4
• redhat virtualization host 4.0
• redhat enterprise linux 8.0
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux eus 7.7
• redhat enterprise linux for real time 7
• redhat enterprise linux for real time 8
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 7.7
• redhat enterprise linux server tus 7.7
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 19.04
• opensuse leap 15.0
• opensuse leap 15.1
• fedoraproject fedora 29
• fedoraproject fedora 30
• debian debian linux 8.0
• debian debian linux 9.0
• debian debian linux 10.0
• netapp aff a700s firmware
• netapp h300s firmware
• netapp h500s firmware
• netapp h700s firmware
• netapp h300e firmware
• netapp h500e firmware
• netapp h700e firmware
• netapp h410s firmware
• netapp h410c firmware
• netapp h610s firmware
• netapp data availability services
• netapp hci management node
• netapp solidfire
• oracle sd-wan edge 7.3
• oracle sd-wan edge 8.0
• oracle sd-wan edge 8.1
• oracle sd-wan edge 8.2
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/09/20/1 Mailing List, Patch, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3309 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3517 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3978 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3979 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4154 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4256 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0027 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0204 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14821 Issue Tracking, Mitigation, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZQQQANZWQMPILZV7OTS3RGGRLLE2Q7/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/ Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Nov/11 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/41 Issue Tracking, Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20191004-0001/ Third Party Advisory
- https://usn.ubuntu.com/4157-1/ Third Party Advisory
- https://usn.ubuntu.com/4157-2/ Third Party Advisory
- https://usn.ubuntu.com/4162-1/ Third Party Advisory
- https://usn.ubuntu.com/4162-2/ Third Party Advisory
- https://usn.ubuntu.com/4163-1/ Third Party Advisory
- https://usn.ubuntu.com/4163-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4531 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/09/20/1 Mailing List, Patch, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3309 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3517 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3978 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3979 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4154 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4256 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0027 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0204 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14821 Issue Tracking, Mitigation, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZQQQANZWQMPILZV7OTS3RGGRLLE2Q7/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/ Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Nov/11 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/41 Issue Tracking, Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20191004-0001/ Third Party Advisory
- https://usn.ubuntu.com/4157-1/ Third Party Advisory
- https://usn.ubuntu.com/4157-2/ Third Party Advisory
- https://usn.ubuntu.com/4162-1/ Third Party Advisory
- https://usn.ubuntu.com/4162-2/ Third Party Advisory
- https://usn.ubuntu.com/4163-1/ Third Party Advisory
- https://usn.ubuntu.com/4163-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4531 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory