CVE-2019-7221 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 16%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	𝑥 ≤ 4.20.5
opensuse	leap	15.0
debian	debian_linux	8.0
canonical	ubuntu_linux	14.04
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	18.04
canonical	ubuntu_linux	18.10
netapp	active_iq_performance_analytics_services	-
netapp	element_software_management_node	-
redhat	openshift_container_platform	3.11
redhat	enterprise_linux	7.0
redhat	enterprise_linux_desktop	7.0
redhat	enterprise_linux_server	7.0
redhat	enterprise_linux_server_aus	7.6
redhat	enterprise_linux_server_eus	7.6
redhat	enterprise_linux_server_tus	7.6
redhat	enterprise_linux_workstation	7.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bookworm	6.1.106-3 fixed
bookworm (security)	6.1.112-1 fixed
bullseye	5.10.223-1 fixed
bullseye (security)	5.10.226-1 fixed
sid	6.11.6-1 fixed
trixie	6.11.5-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

linux

bionic	Fixed 4.15.0-47.50 released
cosmic	Fixed 4.18.0-17.18 released
disco	not-affected
trusty	not-affected
xenial	Fixed 4.4.0-145.171 released

linux-aws

bionic	Fixed 4.15.0-1035.37 released
cosmic	Fixed 4.18.0-1012.14 released
disco	not-affected
trusty	Fixed 4.4.0-1040.43 released
xenial	Fixed 4.4.0-1079.89 released

linux-aws-hwe

bionic	dne
cosmic	dne
disco	dne
trusty	dne
xenial	Fixed 4.15.0-1035.37~16.04.1 released

linux-azure

bionic	Fixed 4.18.0-1014.14~18.04.1 released
cosmic	Fixed 4.18.0-1014.14 released
disco	not-affected
trusty	Fixed 4.15.0-1041.45~14.04.1 released
xenial	Fixed 4.15.0-1041.45 released

linux-azure-edge

bionic	Fixed 4.18.0-1014.14~18.04.1 released
cosmic	dne
disco	dne
trusty	dne
xenial	Fixed 4.15.0-1041.45 released

linux-euclid

bionic	dne
cosmic	dne
disco	dne
trusty	dne
xenial	ignored

linux-flo

bionic	dne
cosmic	dne
disco	dne
trusty	dne
xenial	ignored

linux-gcp

bionic	Fixed 4.15.0-1029.31 released
cosmic	Fixed 4.18.0-1008.9 released
disco	not-affected
trusty	dne
xenial	Fixed 4.15.0-1029.31~16.04.1 released

linux-gcp-edge

bionic	Fixed 4.18.0-1008.9~18.04.1 released
cosmic	dne
disco	dne
trusty	dne
xenial	dne

linux-gke

bionic	not-affected
cosmic	dne
disco	dne
trusty	dne
xenial	ignored

linux-goldfish

bionic	dne
cosmic	dne
disco	dne
trusty	dne
xenial	ignored

linux-grouper

bionic	dne
cosmic	dne
disco	dne
trusty	dne
xenial	dne

linux-hwe

bionic	Fixed 4.18.0-17.18~18.04.1 released
cosmic	dne
disco	dne
trusty	dne
xenial	Fixed 4.15.0-47.50~16.04.1 released

linux-hwe-edge

bionic	not-affected
cosmic	dne
disco	dne
trusty	dne
xenial	Fixed 4.15.0-47.50~16.04.1 released

linux-kvm

bionic	Fixed 4.15.0-1031.31 released
cosmic	Fixed 4.18.0-1009.9 released
disco	not-affected
trusty	dne
xenial	Fixed 4.4.0-1043.49 released

linux-lts-trusty

bionic	dne
cosmic	dne
disco	dne
trusty	dne
xenial	dne

linux-lts-utopic

bionic	dne
cosmic	dne
disco	dne
trusty	ignored
xenial	dne

linux-lts-vivid

bionic	dne
cosmic	dne
disco	dne
trusty	ignored
xenial	dne

linux-lts-wily

bionic	dne
cosmic	dne
disco	dne
trusty	ignored
xenial	dne

linux-lts-xenial

bionic	dne
cosmic	dne
disco	dne
trusty	Fixed 4.4.0-144.170~14.04.1 released
xenial	dne

linux-maguro

bionic	dne
cosmic	dne
disco	dne
trusty	dne
xenial	dne

linux-mako

bionic	dne
cosmic	dne
disco	dne
trusty	dne
xenial	ignored

linux-manta

bionic	dne
cosmic	dne
disco	dne
trusty	dne
xenial	dne

linux-oem

bionic	Fixed 4.15.0-1035.40 released
cosmic	Fixed 4.15.0-1035.40 released
disco	not-affected
trusty	dne
xenial	ignored

linux-oracle

bionic	Fixed 4.15.0-1010.12 released
cosmic	Fixed 4.15.0-1010.12 released
disco	not-affected
trusty	dne
xenial	Fixed 4.15.0-1010.12~16.04.1 released

linux-raspi2

bionic	Fixed 4.15.0-1033.35 released
cosmic	Fixed 4.18.0-1011.13 released
disco	not-affected
trusty	dne
xenial	Fixed 4.4.0-1106.114 released

linux-snapdragon

bionic	Fixed 4.15.0-1053.57 released
cosmic	dne
disco	not-affected
trusty	dne
xenial	Fixed 4.4.0-1110.115 released

Known Exploits!

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

References

http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00042.html

http://packetstormsecurity.com/files/151713/KVM-VMX-Preemption-Timer-Use-After-Free.html

http://www.openwall.com/lists/oss-security/2019/02/18/2

https://access.redhat.com/errata/RHBA-2019:0959

https://access.redhat.com/errata/RHSA-2019:0818

https://access.redhat.com/errata/RHSA-2019:0833

https://access.redhat.com/errata/RHSA-2019:3967

https://access.redhat.com/errata/RHSA-2019:4058

https://bugs.chromium.org/p/project-zero/issues/detail?id=1760

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ecec76885bcfe3294685dc363fd1273df0d5d65f

https://github.com/torvalds/linux/commits/master/arch/x86/kvm

https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html

https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html

https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDOXCX3QFVWYXH5CQMGDDE7H6MUG5XGG/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y2HMABEMJDPA6LPCBE5WIEZXUKY7DLTN/

https://security.netapp.com/advisory/ntap-20190404-0002/

https://support.f5.com/csp/article/K08413011

https://usn.ubuntu.com/3930-1/

https://usn.ubuntu.com/3930-2/

https://usn.ubuntu.com/3931-1/

https://usn.ubuntu.com/3931-2/

https://usn.ubuntu.com/3932-1/

https://usn.ubuntu.com/3932-2/