CVE-2019-3882
Medium
Description
A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Linux Kernel
PublishedApr 24, 2019
First seenApr 24, 2019
Weakness typeCWE-770Allocation of resources without limits
How to fix
Vendor advisories
- usn.ubuntu.com/3981-1/
- usn.ubuntu.com/3980-1/
- usn.ubuntu.com/3979-1/
- usn.ubuntu.com/3982-2/
- usn.ubuntu.com/3982-1/
- usn.ubuntu.com/3980-2/
- usn.ubuntu.com/3981-2/
- access.redhat.com/errata/RHSA-2019:2043
- access.redhat.com/errata/RHSA-2019:2029
- debian.org/security/2019/dsa-4497
- access.redhat.com/errata/RHSA-2019:3309
- access.redhat.com/errata/RHSA-2019:3517
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.10, 4.14, 4.18 | — |
| fedoraproject fedora | No range specified | — |
| debian debian_linux | 8.0, 9.0, 10.0 | — |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 18.10, 19.04 | — |
| opensuse leap | 15.0, 15.1, 42.3 | — |
| netapp active_iq_unified_manager_for_vmware_vsphere | 9.5 ≤ v | — |
| netapp hci_management_node | No range specified | — |
| netapp snapprotect | No range specified | — |
| netapp solidfire | No range specified | — |
| netapp storage_replication_adapter_for_clustered_data_ontap_for_vmware_vsphere | 7.2 ≤ v | — |
| netapp vasa_provider_for_clustered_data_ontap | 7.2 ≤ v | — |
| netapp virtual_storage_console_for_vmware_vsphere | 7.2 ≤ v | — |
| netapp cn1610_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.