CVE-2019-3840: opensuse leap NULL Pointer Dereference

CVSS: 6.3v3.0MediumModified

AliasesMGASA-2019-0138SUSE-SU-2019:0553-1SUSE-SU-2019:0936-1+5 more

Published 27-03-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-3840 is a medium (CVSS 6.3) NULL Pointer Dereference vulnerability in opensuse leap. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.7% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.3/10

010

Medium · v3.0 (NVD)

EPSS score

1.48%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

SUSE-SU-2019:0948-1 SUSE-SU-2019:1042-1

Timeline

27-03-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.06.3v2.03.5

EPSS trend

Probability

1.48%

Chance of exploitation in the next 30 days

Percentile

74%

Versus all other CVEs

30-day change

0.00 pp

From 1.48% on 21-09-2026

21-09-202621-10-2026

EPSS score

1.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
referenceUnverified
Exploit Reference (redhat.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.

Affected systems

Redhat33 products

libvirt< 5.0.0
libvirt< 0:4.5.0-23.el7
libvirt-admin< 0:4.5.0-23.el7
libvirt-bash-completion< 0:4.5.0-23.el7
libvirt-client< 0:4.5.0-23.el7

Show all 33

Suse7 products

libvirt&distro=SUSE Enterprise Storage 4< 2.0.0-27.48.1
libvirt&distro=SUSE Linux Enterprise Module for Basesystem 15< 4.0.0-9.16.7
libvirt&distro=SUSE Linux Enterprise Module for Server Applications 15< 4.0.0-9.16.7
libvirt&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 2.0.0-27.48.1
libvirt&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 2.0.0-27.48.1

Show all 7

Opensuse2 products

leapEOL15.0 | 42.3
libvirt&distro=openSUSE Leap 15.0< 4.0.0-lp150.7.10.4

Debian1 product

libvirt< 5.0.0-1

Mageia1 product

libvirt< 3.10.0-1.5.mga6

The libvirt project1 product

libvirt5.0.0

Ubuntu1 product

libvirt< 1.3.1-1ubuntu10.25 | < 4.0.0-1ubuntu8.8

7 vendors · 46 products

References

80 links

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3840X Refsource CONFIRMExploitIssue TrackingPatchVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=1663051X Refsource CONFIRMREPORTExploitIssue TrackingThird Party AdvisoryVendor Advisory
www.redhat.com/archives/libvir-list/2019-January/msg00241.htmlX Refsource CONFIRMREPORTExploitVendor Advisory
lists.opensuse.org/opensuse-security-announce/2019-04/msg00101.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-04/msg00105.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
access.redhat.com/errata/RHSA-2019:2294Vendor AdvisoryX Refsource REDHATAdvisory
advisories.mageia.org/MGASA-2019-0138.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=24528REPORT
usn.ubuntu.com/3909-1/WEB

Show all 80 references

www.suse.com/support/update/announcement/2019/suse-su-20190553-1/Advisory
bugzilla.suse.com/1104662REPORT
bugzilla.suse.com/1120813REPORT
bugzilla.suse.com/1127458REPORT
www.suse.com/security/cve/CVE-2019-3840WEB
www.suse.com/support/update/announcement/2019/suse-su-20190936-1/Advisory
bugzilla.suse.com/1081516REPORT
bugzilla.suse.com/1102604REPORT
bugzilla.suse.com/1106420REPORT
bugzilla.suse.com/1108086REPORT
bugzilla.suse.com/1108395REPORT
bugzilla.suse.com/1112182REPORT
bugzilla.suse.com/1117058REPORT
bugzilla.suse.com/1118952REPORT
bugzilla.suse.com/1123642REPORT
bugzilla.suse.com/1124667REPORT
bugzilla.suse.com/1125665REPORT
bugzilla.suse.com/1126325REPORT
bugzilla.suse.com/1130129REPORT
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/indexARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1501450REPORT
bugzilla.redhat.com/show_bug.cgi?id=1558558REPORT
bugzilla.redhat.com/show_bug.cgi?id=1584663REPORT
bugzilla.redhat.com/show_bug.cgi?id=1592737REPORT
bugzilla.redhat.com/show_bug.cgi?id=1594266REPORT
bugzilla.redhat.com/show_bug.cgi?id=1609454REPORT
bugzilla.redhat.com/show_bug.cgi?id=1609720REPORT
bugzilla.redhat.com/show_bug.cgi?id=1612943REPORT
bugzilla.redhat.com/show_bug.cgi?id=1613737REPORT
bugzilla.redhat.com/show_bug.cgi?id=1615680REPORT
bugzilla.redhat.com/show_bug.cgi?id=1628469REPORT
bugzilla.redhat.com/show_bug.cgi?id=1628892REPORT
bugzilla.redhat.com/show_bug.cgi?id=1631606REPORT
bugzilla.redhat.com/show_bug.cgi?id=1631622REPORT
bugzilla.redhat.com/show_bug.cgi?id=1632833REPORT
bugzilla.redhat.com/show_bug.cgi?id=1633077REPORT
bugzilla.redhat.com/show_bug.cgi?id=1633389REPORT
bugzilla.redhat.com/show_bug.cgi?id=1640465REPORT
bugzilla.redhat.com/show_bug.cgi?id=1641702REPORT
bugzilla.redhat.com/show_bug.cgi?id=1647365REPORT
bugzilla.redhat.com/show_bug.cgi?id=1652894REPORT
bugzilla.redhat.com/show_bug.cgi?id=1656360REPORT
bugzilla.redhat.com/show_bug.cgi?id=1657468REPORT
bugzilla.redhat.com/show_bug.cgi?id=1658198REPORT
bugzilla.redhat.com/show_bug.cgi?id=1658406REPORT
bugzilla.redhat.com/show_bug.cgi?id=1658652REPORT
bugzilla.redhat.com/show_bug.cgi?id=1660531REPORT
bugzilla.redhat.com/show_bug.cgi?id=1665228REPORT
bugzilla.redhat.com/show_bug.cgi?id=1665474REPORT
bugzilla.redhat.com/show_bug.cgi?id=1665553REPORT
bugzilla.redhat.com/show_bug.cgi?id=1669581REPORT
bugzilla.redhat.com/show_bug.cgi?id=1669586REPORT
bugzilla.redhat.com/show_bug.cgi?id=1672957REPORT
bugzilla.redhat.com/show_bug.cgi?id=1683175REPORT
bugzilla.redhat.com/show_bug.cgi?id=1690122REPORT
bugzilla.redhat.com/show_bug.cgi?id=1690703REPORT
bugzilla.redhat.com/show_bug.cgi?id=1691358REPORT
bugzilla.redhat.com/show_bug.cgi?id=1692296REPORT
bugzilla.redhat.com/show_bug.cgi?id=1703661REPORT
bugzilla.redhat.com/show_bug.cgi?id=1716387REPORT
bugzilla.redhat.com/show_bug.cgi?id=1718172REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2294.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-3840REPORT
www.cve.org/CVERecord?id=CVE-2019-3840AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2019-3840Advisory
ubuntu.com/security/CVE-2019-3840REPORT
ubuntu.com/security/notices/USN-3909-1Advisory
security-tracker.debian.org/tracker/CVE-2019-3840Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities