CVE-2019-14283MEDIUM
Description
In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default.
References
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html
http://packetstormsecurity.com/files/154408/Kernel-Live-Patch-Security-Notice-LSN-0055-1.html
http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://github.com/torvalds/linux/commit/da99466ac243f15fbba65bd261bfc75ffa1532b6
https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html
https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html
https://seclists.org/bugtraq/2019/Aug/13
https://seclists.org/bugtraq/2019/Aug/18
https://seclists.org/bugtraq/2019/Aug/26
https://security.netapp.com/advisory/ntap-20190905-0002/
https://usn.ubuntu.com/4114-1/
https://usn.ubuntu.com/4115-1/
https://usn.ubuntu.com/4116-1/
https://usn.ubuntu.com/4117-1/
https://usn.ubuntu.com/4118-1/
Details
Source: MITRE
Published: 2019-07-26
Updated: 2019-08-11
Type: CWE-125
Risk Information
CVSS v2.0
Base Score: 4.6
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 3.9
Severity: MEDIUM
CVSS v3.0
Base Score: 6.8
Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 0.9
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 143971 | NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel Multiple Vulnerabilities (NS-SA-2020-0108) | Nessus | NewStart CGSL Local Security Checks | critical |
| 141405 | NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2020-0043) | Nessus | NewStart CGSL Local Security Checks | high |
| 141400 | NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2020-0041) | Nessus | NewStart CGSL Local Security Checks | high |
| 137363 | RHEL 7 : kernel (RHSA-2020:2522) | Nessus | Red Hat Local Security Checks | high |
| 135813 | Scientific Linux Security Update : kernel on SL7.x x86_64 (20200407) | Nessus | Scientific Linux Local Security Checks | high |
| 135316 | CentOS 7 : kernel (CESA-2020:1016) | Nessus | CentOS Local Security Checks | high |
| 135080 | RHEL 7 : kernel (RHSA-2020:1016) | Nessus | Red Hat Local Security Checks | high |
| 135078 | RHEL 7 : kernel-rt (RHSA-2020:1070) | Nessus | Red Hat Local Security Checks | high |
| 134387 | EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1186) | Nessus | Huawei Local Security Checks | critical |
| 131845 | EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-2353) | Nessus | Huawei Local Security Checks | critical |
| 130736 | EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-2274) | Nessus | Huawei Local Security Checks | critical |
| 129841 | Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4820) | Nessus | Oracle Linux Local Security Checks | high |
| 129575 | Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2019-4812) | Nessus | Oracle Linux Local Security Checks | high |
| 129551 | Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4810) | Nessus | Oracle Linux Local Security Checks | high |
| 129550 | OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0046) | Nessus | OracleVM Local Security Checks | medium |
| 129515 | Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4808) | Nessus | Oracle Linux Local Security Checks | medium |
| 129284 | SUSE SLED15 / SLES15 Security Update : kernel-source-rt (SUSE-SU-2019:2430-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (SACK Panic) (SACK Slowness) (Spectre) | Nessus | SuSE Local Security Checks | high |
| 128929 | EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2019-1926) | Nessus | Huawei Local Security Checks | critical |
| 128842 | EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1919) | Nessus | Huawei Local Security Checks | high |
| 128732 | Photon OS 3.0: Linux PHSA-2019-3.0-0026 | Nessus | PhotonOS Local Security Checks | high |
| 128725 | Photon OS 2.0: Linux PHSA-209-2.0-0175 | Nessus | PhotonOS Local Security Checks | high |
| 128680 | Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel regression (USN-4115-2) | Nessus | Ubuntu Local Security Checks | critical |
| 128542 | SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2299-1) | Nessus | SuSE Local Security Checks | medium |
| 128478 | Ubuntu 16.04 LTS / 18.04 LTS : linux-aws vulnerabilities (USN-4118-1) | Nessus | Ubuntu Local Security Checks | critical |
| 128477 | Ubuntu 19.04 : linux-aws vulnerabilities (USN-4117-1) | Nessus | Ubuntu Local Security Checks | high |
| 128476 | Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-4116-1) | Nessus | Ubuntu Local Security Checks | medium |
| 128475 | Ubuntu 16.04 LTS / 18.04 LTS : linux, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, (USN-4115-1) | Nessus | Ubuntu Local Security Checks | critical |
| 128474 | Ubuntu 18.04 LTS / 19.04 : linux, linux-azure, linux-gcp, linux-gke-5.0, linux-hwe, linux-kvm, (USN-4114-1) | Nessus | Ubuntu Local Security Checks | medium |
| 128470 | SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2263-1) | Nessus | SuSE Local Security Checks | medium |
| 128469 | SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2262-1) | Nessus | SuSE Local Security Checks | medium |
| 128012 | openSUSE Security Update : the Linux Kernel (openSUSE-2019-1924) | Nessus | SuSE Local Security Checks | medium |
| 128011 | openSUSE Security Update : the Linux Kernel (openSUSE-2019-1923) | Nessus | SuSE Local Security Checks | medium |
| 127921 | Debian DLA-1885-1 : linux-4.9 security update | Nessus | Debian Local Security Checks | high |
| 127882 | Slackware 14.2 : Slackware 14.2 kernel (SSA:2019-226-01) | Nessus | Slackware Local Security Checks | high |
| 127867 | Debian DSA-4497-1 : linux - security update | Nessus | Debian Local Security Checks | high |
| 127866 | Debian DLA-1884-1 : linux security update | Nessus | Debian Local Security Checks | high |
| 127776 | SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:2073-1) | Nessus | SuSE Local Security Checks | medium |
| 127775 | SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:2072-1) | Nessus | SuSE Local Security Checks | medium |
| 127774 | SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:2071-1) | Nessus | SuSE Local Security Checks | medium |
| 127773 | SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2070-1) | Nessus | SuSE Local Security Checks | medium |
| 127772 | SUSE SLED15 / SLES15 Security Update : Linux Azure Kernel (SUSE-SU-2019:2068-1) | Nessus | SuSE Local Security Checks | medium |
| 127491 | Debian DSA-4495-1 : linux - security update | Nessus | Debian Local Security Checks | high |