CVEvulnerability

CVE-2019-3882

5.5 MEDIUM Published 2019-04-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-04-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
4.7 MEDIUM — CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.9 MEDIUM — AV:L/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-770

Description

A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable.

Affected configurations

• linux linux kernel 3.10 • linux linux kernel 4.14 • linux linux kernel 4.18 • fedoraproject fedora • debian debian linux 8.0 • debian debian linux 9.0 • debian debian linux 10.0 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 18.10 • canonical ubuntu linux 19.04 • opensuse leap 15.0 • opensuse leap 15.1 • opensuse leap 42.3 • netapp active iq unified manager for vmware vsphere (>= 9.5) • netapp hci management node • netapp snapprotect • netapp solidfire • netapp storage replication adapter for clustered data ontap for vmware vsphere (>= 7.2) • netapp vasa provider for clustered data ontap (>= 7.2) • netapp virtual storage console for vmware vsphere (>= 7.2) • netapp cn1610 firmware

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References