CVE-2019-11815: canonical ubuntu_linux
Modified
AliasesUBUNTU-CVE-2019-11815DEBIAN-CVE-2019-11815
Published 08-05-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-11815 is a high (CVSS 9.3) vulnerability in canonical ubuntu_linux. EPSS estimates a 4.44% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities. 2 public exploits are recorded.
Priority
Prioritisepublic exploit
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?CVSS score
9.3/10
010
High · v2.0 (NVD)EPSS score
4.44%
0%100%
Low · -0.02 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2github, reference
Advisory lineage
Upstream 0 · Downstream 18 · Related 16Timeline
- 08-05-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.
CVSS metrics
5 scores · 3 sources · 3 versionsHigh 7.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesSingle source
High 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
High 9.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
4.44%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
Decrease -0.02 pp
From 4.46% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundLinux
Maturity: poc
Exploit Reference (git.kernel.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu24 products
- linux< 4.4.0-150.176 | < 4.15.0-55.60
- linux-aws< 4.4.0-1054.58 | < 4.4.0-1084.94 | < 4.15.0-1047.49
- linux-aws-fips< 4.15.0-2018.18 | All versions (No fix recorded)
- linux-aws-hwe< 4.15.0-1047.49~16.04.1
- linux-azure< 4.15.0-1059.64~14.04.1 | < 4.15.0-1051.56 | < 4.18.0-1025.27~18.04.1
Netapp10 products
- active_iq_unified_manager≥ 9.5 (No fix recorded)
- cn1610_firmwarena
- hci_compute_nodena
- hci_management_nodena
- hci_storage_node_firmwarena
Debian2 products
- linux< 4.19.37-1
- debian_linuxEOL8.0 | 9.0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 19.04
Linux1 product
- linux_kernel≥ 4.3, < 4.4.179 | ≥ 4.9, < 4.9.169 | ≥ 4.14, < 4.14.112 | ≥ 4.19, < 4.19.35 | ≥ 5.0, < 5.0.8 | 5.1:rc1 | 5.1:rc2 | 5.1:rc3 | 5.1:rc4
Opensuse1 product
- leapEOL15.0 | 15.1 | 42.3
6 vendors · 39 products
References
28 links- cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8X Refsource MISCRelease NotesVendor AdvisoryREPORT
- github.com/torvalds/linux/commit/cb66ddd156203daefb8d71158036b27b0e2caf63X Refsource MISCExploitPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 28 references
- lists.debian.org/debian-lts-announce/2019/06/msg00011.htmlMailing ListX Refsource MLISTThird Party Advisory
- packetstormsecurity.com/files/153799/Kernel-Live-Patch-Security-Notice-LSN-0053-1.htmlX Refsource MISCThird Party AdvisoryVDB Entry