CVE-2019-19062

MEDIUM

Description

A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042.

References

http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html

http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

https://github.com/torvalds/linux/commit/ffdde5932042600c6807d46c1550b28b0db6a3bc

https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html

https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/

https://lists.fedoraproject.org/archives/list/[email protected]/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T/

https://seclists.org/bugtraq/2020/Jan/10

https://security.netapp.com/advisory/ntap-20191205-0001/

https://usn.ubuntu.com/4254-1/

https://usn.ubuntu.com/4254-2/

https://usn.ubuntu.com/4258-1/

https://usn.ubuntu.com/4284-1/

https://usn.ubuntu.com/4287-1/

https://usn.ubuntu.com/4287-2/

Details

Source: MITRE

Published: 2019-11-18

Updated: 2020-08-24

Type: CWE-401

Risk Information

CVSS v2.0

Base Score: 4.7

Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C

Impact Score: 6.9

Exploitability Score: 3.4

Severity: MEDIUM

CVSS v3.0

Base Score: 4.7

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 1

Severity: MEDIUM

Vulnerable Software

Configuration 1

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to 5.3.11 (inclusive)

Configuration 2

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Tenable Plugins

View all (34 total)

ID	Name	Product	Family	Severity
141374	OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0044)	Nessus	OracleVM Local Security Checks	critical
141057	RHEL 7 : kernel (RHSA-2020:4060)	Nessus	Red Hat Local Security Checks	high
141026	RHEL 7 : kernel-rt (RHSA-2020:4062)	Nessus	Red Hat Local Security Checks	high
140361	OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0041)	Nessus	OracleVM Local Security Checks	high
140208	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5837)	Nessus	Oracle Linux Local Security Checks	high
139541	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5802)	Nessus	Oracle Linux Local Security Checks	medium
139476	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5804)	Nessus	Oracle Linux Local Security Checks	high
137516	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2020-1674)	Nessus	Huawei Local Security Checks	critical
136661	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1255-1)	Nessus	SuSE Local Security Checks	critical
135525	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2020-1396)	Nessus	Huawei Local Security Checks	critical
134735	EulerOS Virtualization 3.0.2.2 : kernel (EulerOS-SA-2020-1269)	Nessus	Huawei Local Security Checks	high
134363	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:0613-1)	Nessus	SuSE Local Security Checks	critical
134240	Debian DLA-2114-1 : linux-4.9 security update	Nessus	Debian Local Security Checks	critical
133992	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1158)	Nessus	Huawei Local Security Checks	critical
133800	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4287-1)	Nessus	Ubuntu Local Security Checks	medium
133797	Ubuntu 18.04 LTS / 19.10 : Linux kernel vulnerabilities (USN-4284-1)	Nessus	Ubuntu Local Security Checks	medium
133557	Amazon Linux AMI : kernel (ALAS-2020-1338)	Nessus	Amazon Linux Local Security Checks	medium
133556	Amazon Linux 2 : kernel (ALAS-2020-1392)	Nessus	Amazon Linux Local Security Checks	medium
133354	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4258-1)	Nessus	Ubuntu Local Security Checks	medium
133293	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4254-1)	Nessus	Ubuntu Local Security Checks	medium
133101	Debian DLA-2068-1 : linux security update	Nessus	Debian Local Security Checks	critical
133061	Photon OS 3.0: Linux PHSA-2019-3.0-0046	Nessus	PhotonOS Local Security Checks	high
132925	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:0093-1)	Nessus	SuSE Local Security Checks	critical
132741	Slackware 14.2 : Slackware 14.2 kernel (SSA:2020-008-01)	Nessus	Slackware Local Security Checks	medium
132394	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:3381-1)	Nessus	SuSE Local Security Checks	critical
132390	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3379-1)	Nessus	SuSE Local Security Checks	high
132389	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:3371-1)	Nessus	SuSE Local Security Checks	high
132237	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:3317-1)	Nessus	SuSE Local Security Checks	critical
132236	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3316-1)	Nessus	SuSE Local Security Checks	critical
132032	openSUSE Security Update : the Linux Kernel (openSUSE-2019-2675)	Nessus	SuSE Local Security Checks	critical
131833	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3200-1)	Nessus	SuSE Local Security Checks	high
131805	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-2531)	Nessus	Huawei Local Security Checks	high
131334	Fedora 31 : kernel (2019-34a75d7e61)	Nessus	Fedora Local Security Checks	high
131332	Fedora 30 : kernel (2019-021c968423)	Nessus	Fedora Local Security Checks	high