CVE-2019-3882

Advisory lineage Upstream: 0 Downstream: 30
Modified
Published: 24 Apr 2019, 15:23
Last modified:04 Aug 2024, 19:19

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v3.1 (nvd)
EPSS Score
0.04% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

24 Apr 2019, 15:23
Published
Vulnerability first disclosed
04 Aug 2024, 19:19
Last Modified
Vulnerability information updated

Description

A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • v3.0•MEDIUM•Score: 4.7CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 4.9AV:L/AC:L/Au:N/C:N/I:N/A:C

EPSS Trends

Current EPSS score: 0.04%• Percentile: 11%

Techniques & Countermeasures

  • CWE-770•Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

  • canonical•ubuntu_linux

    14.04 | 16.04 | 18.04 | 18.10 | 19.04

  • debian•debian_linux

    8.0 | 9.0 | 10.0

  • linux•linux_kernel

    3.10 | 4.14 | 4.1.8

  • netapp•active_iq_unified_manager_for_vmware_vsphere

    ≥ 9.5

  • netapp•cn1610_firmware

    na

  • netapp•hci_management_node

    na

  • netapp•snapprotect

    na

  • netapp•solidfire

    na

  • netapp•storage_replication_adapter_for_clustered_data_ontap_for_vmware_vsphere

    ≥ 7.2

  • netapp•vasa_provider_for_clustered_data_ontap

    ≥ 7.2

  • netapp•virtual_storage_console_for_vmware_vsphere

    ≥ 7.2

  • opensuse•leap

    15.0 | 15.1 | 42.3

  • the linux foundation•kernel

    3.10, 4.14, 4.18

References (21)