CVE-2019-11599

MEDIUM

Description

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.

References

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html

http://packetstormsecurity.com/files/152663/Linux-Missing-Lockdown.html

http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

http://www.openwall.com/lists/oss-security/2019/04/29/1

http://www.openwall.com/lists/oss-security/2019/04/29/2

http://www.openwall.com/lists/oss-security/2019/04/30/1

http://www.securityfocus.com/bid/108113

https://access.redhat.com/errata/RHSA-2019:2029

https://access.redhat.com/errata/RHSA-2019:2043

https://access.redhat.com/errata/RHSA-2019:3309

https://access.redhat.com/errata/RHSA-2019:3517

https://access.redhat.com/errata/RHSA-2020:0100

https://access.redhat.com/errata/RHSA-2020:0103

https://access.redhat.com/errata/RHSA-2020:0179

https://access.redhat.com/errata/RHSA-2020:0543

https://bugs.chromium.org/p/project-zero/issues/detail?id=1790

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.114

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.37

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.10

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=04f5866e41fb70690e28397487d8bd8eea7d712a

https://github.com/torvalds/linux/commit/04f5866e41fb70690e28397487d8bd8eea7d712a

https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html

https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html

https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html

https://seclists.org/bugtraq/2019/Jul/33

https://seclists.org/bugtraq/2019/Jun/26

https://security.netapp.com/advisory/ntap-20190517-0002/

https://security.netapp.com/advisory/ntap-20200608-0001/

https://support.f5.com/csp/article/K51674118

https://support.f5.com/csp/article/K51674118?utm_source=f5support&utm_medium=RSS

https://usn.ubuntu.com/4069-1/

https://usn.ubuntu.com/4069-2/

https://usn.ubuntu.com/4095-1/

https://usn.ubuntu.com/4115-1/

https://usn.ubuntu.com/4118-1/

https://www.debian.org/security/2019/dsa-4465

https://www.exploit-db.com/exploits/46781/

Details

Source: MITRE

Published: 2019-04-29

Updated: 2020-08-24

Type: CWE-667

Risk Information

CVSS v2.0

Base Score: 6.9

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 3.4

Severity: MEDIUM

CVSS v3.0

Base Score: 7

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Tenable Plugins

View all (48 total)

IDNameProductFamilySeverity
145665CentOS 8 : kernel (CESA-2019:3517)NessusCentOS Local Security Checks
high
144831EulerOS Virtualization 3.0.2.6 : kernel (EulerOS-SA-2021-1056)NessusHuawei Local Security Checks
critical
137291Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5715)NessusOracle Linux Local Security Checks
critical
134387EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1186)NessusHuawei Local Security Checks
critical
133786RHEL 7 : kernel (RHSA-2020:0543)NessusRed Hat Local Security Checks
high
133538Scientific Linux Security Update : kernel on SL7.x x86_64 (20200205)NessusScientific Linux Local Security Checks
critical
133164RHEL 7 : kernel (RHSA-2020:0179)NessusRed Hat Local Security Checks
medium
132947RHEL 6 : kernel-rt (RHSA-2020:0100)NessusRed Hat Local Security Checks
medium
132886RHEL 7 : kernel (RHSA-2020:0103)NessusRed Hat Local Security Checks
medium
132495NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0253)NessusNewStart CGSL Local Security Checks
high
132474NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0247)NessusNewStart CGSL Local Security Checks
high
130547RHEL 8 : kernel (RHSA-2019:3517)NessusRed Hat Local Security Checks
high
130526RHEL 8 : kernel-rt (RHSA-2019:3309)NessusRed Hat Local Security Checks
high
129920NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0183)NessusNewStart CGSL Local Security Checks
high
129900NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0180)NessusNewStart CGSL Local Security Checks
high
129284SUSE SLED15 / SLES15 Security Update : kernel-source-rt (SUSE-SU-2019:2430-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (SACK Panic) (SACK Slowness) (Spectre)NessusSuSE Local Security Checks
high
128680Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel regression (USN-4115-2)NessusUbuntu Local Security Checks
critical
128651CentOS 7 : kernel (CESA-2019:2029)NessusCentOS Local Security Checks
high
128478Ubuntu 16.04 LTS / 18.04 LTS : linux-aws vulnerabilities (USN-4118-1)NessusUbuntu Local Security Checks
critical
128475Ubuntu 16.04 LTS / 18.04 LTS : linux, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, (USN-4115-1)NessusUbuntu Local Security Checks
critical
128226Scientific Linux Security Update : kernel on SL7.x x86_64 (20190806)NessusScientific Linux Local Security Checks
high
127890Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4095-1)NessusUbuntu Local Security Checks
high
127792Ubuntu 18.04 LTS : linux-hwe vulnerabilities (USN-4069-2)NessusUbuntu Local Security Checks
high
127655RHEL 7 : kernel-rt (RHSA-2019:2043)NessusRed Hat Local Security Checks
high
127650RHEL 7 : kernel (RHSA-2019:2029)NessusRed Hat Local Security Checks
high
127060Amazon Linux AMI : kernel (ALAS-2019-1232)NessusAmazon Linux Local Security Checks
medium
126956Amazon Linux 2 : kernel (ALAS-2019-1232)NessusAmazon Linux Local Security Checks
medium
126950Ubuntu 19.04 : Linux kernel vulnerabilities (USN-4069-1)NessusUbuntu Local Security Checks
high
126897openSUSE Security Update : the Linux Kernel (openSUSE-2019-1757)NessusSuSE Local Security Checks
high
126884openSUSE Security Update : the Linux Kernel (openSUSE-2019-1716)NessusSuSE Local Security Checks
high
126882Slackware 14.2 : Slackware 14.2 kernel (SSA:2019-202-01)NessusSlackware Local Security Checks
high
126744SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1855-1) (SACK Slowness)NessusSuSE Local Security Checks
high
126743SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1854-1)NessusSuSE Local Security Checks
high
126742SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1852-1)NessusSuSE Local Security Checks
high
126741SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:1851-1) (SACK Slowness)NessusSuSE Local Security Checks
high
126691SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1829-1)NessusSuSE Local Security Checks
high
126688SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1823-1)NessusSuSE Local Security Checks
high
126299EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-1672)NessusHuawei Local Security Checks
high
126266EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-1639)NessusHuawei Local Security Checks
high
126115Photon OS 3.0: Linux PHSA-2019-3.0-0015NessusPhotonOS Local Security Checks
high
126009Debian DLA-1824-1 : linux-4.9 security update (SACK Panic) (SACK Slowness)NessusDebian Local Security Checks
high
125959Debian DSA-4465-1 : linux - security update (SACK Panic) (SACK Slowness)NessusDebian Local Security Checks
high
125587EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2019-1635)NessusHuawei Local Security Checks
high
125564EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1612)NessusHuawei Local Security Checks
high
125515EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1588)NessusHuawei Local Security Checks
medium
125478Debian DLA-1799-2 : linux security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)NessusDebian Local Security Checks
high
125401Photon OS 1.0: Linux PHSA-2019-1.0-0235NessusPhotonOS Local Security Checks
medium
125396Photon OS 2.0: Linux PHSA-2019-2.0-0160NessusPhotonOS Local Security Checks
high