CVE-2019-11599

EUVD-2019-3269

29.04.2019, 18:29

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7 HIGH	LOCAL	HIGH	LOW	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 66%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	2.16.12 ≤ 𝑥 < 3.16.66
linux	linux_kernel	3.17 ≤ 𝑥 < 4.4.183
linux	linux_kernel	4.5 ≤ 𝑥 < 4.9.188
linux	linux_kernel	4.10 ≤ 𝑥 < 4.14.114
linux	linux_kernel	4.15 ≤ 𝑥 < 4.19.37
linux	linux_kernel	4.20 ≤ 𝑥 < 5.0.10

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bookworm	6.1.106-3 fixed
bookworm (security)	6.1.112-1 fixed
bullseye	5.10.223-1 fixed
bullseye (security)	5.10.226-1 fixed
sid	6.11.6-1 fixed
trixie	6.11.5-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

linux

bionic	Fixed 4.15.0-60.67 released
cosmic	ignored
disco	Fixed 5.0.0-21.22 released
eoan	not-affected
trusty	ignored
xenial	Fixed 4.4.0-159.187 released

linux-aws

bionic	Fixed 4.15.0-1047.49 released
cosmic	ignored
disco	Fixed 5.0.0-1011.12 released
eoan	not-affected
trusty	ignored
xenial	Fixed 4.4.0-1090.101 released

linux-aws-5.0

bionic	not-affected
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-aws-hwe

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	Fixed 4.15.0-1047.49~16.04.1 released

linux-azure

bionic	Fixed 5.0.0-1014.14~18.04.1 released
cosmic	ignored
disco	Fixed 5.0.0-1012.12 released
eoan	not-affected
trusty	ignored
xenial	Fixed 4.15.0-1056.61 released

linux-azure-5.3

bionic	not-affected
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-azure-edge

bionic	Fixed 5.0.0-1014.14~18.04.1 released
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	Fixed 4.15.0-1056.61 released

linux-euclid

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	ignored

linux-flo

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	ignored

linux-gcp

bionic	Fixed 4.15.0-1042.45 released
cosmic	ignored
disco	Fixed 5.0.0-1011.11 released
eoan	not-affected
trusty	dne
xenial	Fixed 4.15.0-1041.43 released

linux-gcp-5.3

bionic	not-affected
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-gcp-edge

bionic	Fixed 4.15.0-1042.45 released
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-gke

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	ignored

linux-gke-4.15

bionic	Fixed 4.15.0-1041.43 released
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-gke-5.0

bionic	not-affected
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-goldfish

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	ignored

linux-grouper

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-hwe

bionic	Fixed 5.0.0-23.24~18.04.1 released
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	Fixed 4.15.0-60.67~16.04.1 released

linux-hwe-edge

bionic	ignored
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	Fixed 4.15.0-60.67~16.04.1 released

linux-kvm

bionic	Fixed 4.15.0-1043.43 released
cosmic	ignored
disco	Fixed 5.0.0-1011.12 released
eoan	not-affected
trusty	dne
xenial	Fixed 4.4.0-1054.61 released

linux-lts-trusty

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-lts-utopic

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-lts-vivid

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-lts-wily

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-lts-xenial

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	ignored
xenial	dne

linux-maguro

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-mako

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	ignored

linux-manta

bionic	dne
cosmic	dne
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-oem

bionic	Fixed 4.15.0-1056.65 released
cosmic	ignored
disco	ignored
eoan	Fixed 4.15.0-1059.68 released
trusty	dne
xenial	ignored

linux-oem-5.4

bionic	dne
eoan	dne
trusty	dne
xenial	dne

linux-oem-osp1

bionic	Fixed 5.0.0-1015.16 released
disco	ignored
eoan	Fixed 5.0.0-1018.20 released
trusty	dne
xenial	dne

linux-oracle

bionic	Fixed 4.15.0-1022.25 released
cosmic	ignored
disco	Fixed 5.0.0-1004.8 released
eoan	not-affected
trusty	dne
xenial	Fixed 4.15.0-1022.25~16.04.1 released

linux-oracle-5.0

bionic	not-affected
disco	dne
eoan	dne
trusty	dne
xenial	dne

linux-raspi2

bionic	Fixed 4.15.0-1044.47 released
cosmic	ignored
disco	Fixed 5.0.0-1013.13 released
eoan	not-affected
trusty	dne
xenial	Fixed 4.4.0-1118.127 released

linux-raspi2-5.3

bionic	not-affected
eoan	dne
trusty	dne
xenial	dne

linux-snapdragon

bionic	Fixed 4.15.0-1062.69 released
cosmic	dne
disco	Fixed 5.0.0-1017.18 released
eoan	dne
trusty	dne
xenial	Fixed 4.4.0-1122.128 released

Known Exploits!

Common Weakness Enumeration

CWE-667 - Improper Locking
The software does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

References

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html

http://packetstormsecurity.com/files/152663/Linux-Missing-Lockdown.html

http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

http://www.openwall.com/lists/oss-security/2019/04/29/1

http://www.openwall.com/lists/oss-security/2019/04/29/2

http://www.openwall.com/lists/oss-security/2019/04/30/1

http://www.securityfocus.com/bid/108113

https://access.redhat.com/errata/RHSA-2019:2029

https://access.redhat.com/errata/RHSA-2019:2043

https://access.redhat.com/errata/RHSA-2019:3309

https://access.redhat.com/errata/RHSA-2019:3517

https://access.redhat.com/errata/RHSA-2020:0100

https://access.redhat.com/errata/RHSA-2020:0103

https://access.redhat.com/errata/RHSA-2020:0179

https://access.redhat.com/errata/RHSA-2020:0543

https://bugs.chromium.org/p/project-zero/issues/detail?id=1790

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.114

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.37

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.10

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=04f5866e41fb70690e28397487d8bd8eea7d712a

https://github.com/torvalds/linux/commit/04f5866e41fb70690e28397487d8bd8eea7d712a

https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html

https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html

https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html

https://seclists.org/bugtraq/2019/Jul/33

https://seclists.org/bugtraq/2019/Jun/26

https://security.netapp.com/advisory/ntap-20190517-0002/

https://security.netapp.com/advisory/ntap-20200608-0001/

https://support.f5.com/csp/article/K51674118

https://support.f5.com/csp/article/K51674118?utm_source=f5support&amp%3Butm_medium=RSS

https://usn.ubuntu.com/4069-1/

https://usn.ubuntu.com/4069-2/

https://usn.ubuntu.com/4095-1/

https://usn.ubuntu.com/4115-1/

https://usn.ubuntu.com/4118-1/

https://www.debian.org/security/2019/dsa-4465

https://www.exploit-db.com/exploits/46781/

https://www.oracle.com/security-alerts/cpuApr2021.html