CVE-2019-15666

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink, which will cause denial of service, because verify_newpolicy_info in net/xfrm/xfrm_user.c mishandles directory validation.

References

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.19

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b805d78d300bcf2c83d6df7da0c818b0fee41427

https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html

https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html

https://security.netapp.com/advisory/ntap-20191004-0001/

https://support.f5.com/csp/article/K53420251?utm_source=f5support&utm_medium=RSS

Details

Source: MITRE

Published: 2019-08-27

Updated: 2020-04-23

Type: CWE-125

Risk Information

CVSS v2

Base Score: 4.9

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

Impact Score: 6.9

Exploitability Score: 3.9

Severity: MEDIUM

CVSS v3

Base Score: 4.4

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 0.8

Severity: MEDIUM

Tenable Plugins

View all (18 total)

IDNameProductFamilySeverity
145665CentOS 8 : kernel (CESA-2019:3517)NessusCentOS Local Security Checks
critical
138306SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1784-1)NessusSuSE Local Security Checks
high
138298SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1767-1)NessusSuSE Local Security Checks
high
135685RHEL 7 : kernel-alt (RHSA-2020:1493)NessusRed Hat Local Security Checks
critical
134387EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1186)NessusHuawei Local Security Checks
critical
131120SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2984-1)NessusSuSE Local Security Checks
critical
130949SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2949-1)NessusSuSE Local Security Checks
critical
130547RHEL 8 : kernel (RHSA-2019:3517)NessusRed Hat Local Security Checks
critical
130526RHEL 8 : kernel-rt (RHSA-2019:3309)NessusRed Hat Local Security Checks
critical
130163SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:2738-1)NessusSuSE Local Security Checks
critical
129845SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2648-1)NessusSuSE Local Security Checks
critical
129841Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4820)NessusOracle Linux Local Security Checks
high
129345openSUSE Security Update : the Linux Kernel (openSUSE-2019-2181)NessusSuSE Local Security Checks
critical
129339openSUSE Security Update : the Linux Kernel (openSUSE-2019-2173)NessusSuSE Local Security Checks
critical
129157SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:2424-1)NessusSuSE Local Security Checks
critical
129156SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:2414-1)NessusSuSE Local Security Checks
critical
129154SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:2412-1)NessusSuSE Local Security Checks
critical
128779Debian DLA-1919-2 : linux-4.9 security updateNessusDebian Local Security Checks
critical