CVE-2019-11599

29.04.2019, 18:29

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7 HIGH	LOCAL	HIGH	LOW	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 66%

Vendor	Product	Version
linux	linux_kernel	2.16.12 ≤ 𝑥 < 3.16.66
linux	linux_kernel	3.17 ≤ 𝑥 < 4.4.183
linux	linux_kernel	4.5 ≤ 𝑥 < 4.9.188
linux	linux_kernel	4.10 ≤ 𝑥 < 4.14.114
linux	linux_kernel	4.15 ≤ 𝑥 < 4.19.37
linux	linux_kernel	4.20 ≤ 𝑥 < 5.0.10

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bullseye	5.10.223-1 fixed
bullseye (security)	5.10.226-1 fixed
bookworm	6.1.106-3 fixed
bookworm (security)	6.1.112-1 fixed
trixie	6.11.5-1 fixed
sid	6.11.6-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

linux

eoan	not-affected
disco	Fixed 5.0.0-21.22 released
cosmic	ignored
bionic	Fixed 4.15.0-60.67 released
xenial	Fixed 4.4.0-159.187 released
trusty	ignored

linux-aws

eoan	not-affected
disco	Fixed 5.0.0-1011.12 released
cosmic	ignored
bionic	Fixed 4.15.0-1047.49 released
xenial	Fixed 4.4.0-1090.101 released
trusty	ignored

linux-aws-5.0

eoan	dne
disco	dne
bionic	not-affected
xenial	dne
trusty	dne

linux-aws-hwe

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	Fixed 4.15.0-1047.49~16.04.1 released
trusty	dne

linux-azure

eoan	not-affected
disco	Fixed 5.0.0-1012.12 released
cosmic	ignored
bionic	Fixed 5.0.0-1014.14~18.04.1 released
xenial	Fixed 4.15.0-1056.61 released
trusty	ignored

linux-azure-5.3

eoan	dne
disco	dne
bionic	not-affected
xenial	dne
trusty	dne

linux-azure-edge

eoan	dne
disco	dne
cosmic	dne
bionic	Fixed 5.0.0-1014.14~18.04.1 released
xenial	Fixed 4.15.0-1056.61 released
trusty	dne

linux-euclid

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	ignored
trusty	dne

linux-flo

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	ignored
trusty	dne

linux-gcp

eoan	not-affected
disco	Fixed 5.0.0-1011.11 released
cosmic	ignored
bionic	Fixed 4.15.0-1042.45 released
xenial	Fixed 4.15.0-1041.43 released
trusty	dne

linux-gcp-5.3

eoan	dne
disco	dne
bionic	not-affected
xenial	dne
trusty	dne

linux-gcp-edge

eoan	dne
disco	dne
cosmic	dne
bionic	Fixed 4.15.0-1042.45 released
xenial	dne
trusty	dne

linux-gke

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	ignored
trusty	dne

linux-gke-4.15

eoan	dne
disco	dne
bionic	Fixed 4.15.0-1041.43 released
xenial	dne
trusty	dne

linux-gke-5.0

eoan	dne
disco	dne
bionic	not-affected
xenial	dne
trusty	dne

linux-goldfish

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	ignored
trusty	dne

linux-grouper

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-hwe

eoan	dne
disco	dne
cosmic	dne
bionic	Fixed 5.0.0-23.24~18.04.1 released
xenial	Fixed 4.15.0-60.67~16.04.1 released
trusty	dne

linux-hwe-edge

eoan	dne
disco	dne
cosmic	dne
bionic	ignored
xenial	Fixed 4.15.0-60.67~16.04.1 released
trusty	dne

linux-kvm

eoan	not-affected
disco	Fixed 5.0.0-1011.12 released
cosmic	ignored
bionic	Fixed 4.15.0-1043.43 released
xenial	Fixed 4.4.0-1054.61 released
trusty	dne

linux-lts-trusty

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-lts-utopic

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-lts-vivid

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-lts-wily

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-lts-xenial

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	dne
trusty	ignored

linux-maguro

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-mako

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	ignored
trusty	dne

linux-manta

eoan	dne
disco	dne
cosmic	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem

eoan	Fixed 4.15.0-1059.68 released
disco	ignored
cosmic	ignored
bionic	Fixed 4.15.0-1056.65 released
xenial	ignored
trusty	dne

linux-oem-5.4

eoan	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem-osp1

eoan	Fixed 5.0.0-1018.20 released
disco	ignored
bionic	Fixed 5.0.0-1015.16 released
xenial	dne
trusty	dne

linux-oracle

eoan	not-affected
disco	Fixed 5.0.0-1004.8 released
cosmic	ignored
bionic	Fixed 4.15.0-1022.25 released
xenial	Fixed 4.15.0-1022.25~16.04.1 released
trusty	dne

linux-oracle-5.0

eoan	dne
disco	dne
bionic	not-affected
xenial	dne
trusty	dne

linux-raspi2

eoan	not-affected
disco	Fixed 5.0.0-1013.13 released
cosmic	ignored
bionic	Fixed 4.15.0-1044.47 released
xenial	Fixed 4.4.0-1118.127 released
trusty	dne

linux-raspi2-5.3

eoan	dne
bionic	not-affected
xenial	dne
trusty	dne

linux-snapdragon

eoan	dne
disco	Fixed 5.0.0-1017.18 released
cosmic	dne
bionic	Fixed 4.15.0-1062.69 released
xenial	Fixed 4.4.0-1122.128 released
trusty	dne

Known Exploits!

Common Weakness Enumeration

CWE-667 - Improper Locking
The software does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

References

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html

http://packetstormsecurity.com/files/152663/Linux-Missing-Lockdown.html

http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

http://www.openwall.com/lists/oss-security/2019/04/29/1

http://www.openwall.com/lists/oss-security/2019/04/29/2

http://www.openwall.com/lists/oss-security/2019/04/30/1

http://www.securityfocus.com/bid/108113

https://access.redhat.com/errata/RHSA-2019:2029

https://access.redhat.com/errata/RHSA-2019:2043

https://access.redhat.com/errata/RHSA-2019:3309

https://access.redhat.com/errata/RHSA-2019:3517

https://access.redhat.com/errata/RHSA-2020:0100

https://access.redhat.com/errata/RHSA-2020:0103

https://access.redhat.com/errata/RHSA-2020:0179

https://access.redhat.com/errata/RHSA-2020:0543

https://bugs.chromium.org/p/project-zero/issues/detail?id=1790

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.114

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.37

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.10

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=04f5866e41fb70690e28397487d8bd8eea7d712a

https://github.com/torvalds/linux/commit/04f5866e41fb70690e28397487d8bd8eea7d712a

https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html

https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html

https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html

https://seclists.org/bugtraq/2019/Jul/33

https://seclists.org/bugtraq/2019/Jun/26

https://security.netapp.com/advisory/ntap-20190517-0002/

https://security.netapp.com/advisory/ntap-20200608-0001/

https://support.f5.com/csp/article/K51674118

https://support.f5.com/csp/article/K51674118?utm_source=f5support&amp%3Butm_medium=RSS

https://usn.ubuntu.com/4069-1/

https://usn.ubuntu.com/4069-2/

https://usn.ubuntu.com/4095-1/

https://usn.ubuntu.com/4115-1/

https://usn.ubuntu.com/4118-1/

https://www.debian.org/security/2019/dsa-4465

https://www.exploit-db.com/exploits/46781/

https://www.oracle.com/security-alerts/cpuApr2021.html