CVE-2019-19332: linux kernel Out-of-bounds Write
Vulnerability summary
CVE-2019-19332 is a medium (CVSS 6.1) Out-of-bounds Write vulnerability in linux kernel. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 52.3% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 6.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 27 · Related 20Timeline
- 09-01-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service.
CVSS metrics
7 scores · 4 sources · 3 versions- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
- NVDNIST6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
- NVDNIST6.1MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS trend
Probability
0.68%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.68% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu34 products
- linuxAll versions (No fix recorded) | < 4.4.0-173.203 | < 4.15.0-88.88
- linux-aws< 4.4.0-1061.65 | < 4.4.0-1101.112 | < 4.15.0-1060.62
- linux-aws-5.0< 5.0.0-1024.27~18.04.1
- linux-aws-fips< 4.15.0-2018.18 | All versions (No fix recorded)
- linux-aws-hwe< 4.15.0-1060.62~16.04.1
Mageia6 products
- kernel< 5.4.2-1.mga7
- kmod-virtualbox< 6.0.14-10.mga7
- kmod-xtables-addons< 3.7-1.mga7
- ldetect-lst< 0.6.7-1.mga7
- wireguard-tools< 0.0.20191205-1.mga7
Linux2 products
- kernel3.13 through 5.4
- linux_kernel≥ 3.13, ≤ 5.4
Debian1 product
- linux< 5.4.6-1
Redhat1 product
- enterprise_linuxEOL7.0 | 8.0
5 vendors · 44 products
References
29 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19332X Refsource CONFIRMExploitIssue TrackingPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2019/12/16/1X Refsource MISCExploitMailing ListThird Party Advisory
- lore.kernel.org/kvm/000000000000ea5ec20598d90e50%40google.com/X Refsource MISC
- packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlX Refsource MISCPatchThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlMailing ListX Refsource MLISTThird Party Advisory- security.netapp.com/advisory/ntap-20200204-0002/X Refsource CONFIRM