CVE-2019-6974: canonical ubuntu_linux
Modified
AliasesUBUNTU-CVE-2019-6974DEBIAN-CVE-2019-6974
Published 15-02-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-6974 is a high (CVSS 8.1) vulnerability in canonical ubuntu_linux. EPSS estimates a 16.52% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 3 public exploits are recorded.
Priority
Prioritisepublic exploit
Public exploit (exploit-database, 15-02-2019)
Source freshness unavailable
How is this decided?CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
16.52%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits3github, reference, exploit-database
Advisory lineage
Upstream 0 · Downstream 36 · Related 26DLA-1731-1DLA-1771-1MGASA-2019-0097MGASA-2019-0098MGASA-2019-0171OPENSUSE-SU-2019:0203-1OPENSUSE-SU-2024:10728-1OPENSUSE-SU-2024:13704-1RHSA-2019:0818RHSA-2019:0833RHSA-2019:2809RHSA-2019:3967RHSA-2020:0103SUSE-SU-2019:0541-1SUSE-SU-2019:0672-1SUSE-SU-2019:0683-1SUSE-SU-2019:0709-1SUSE-SU-2019:0722-1SUSE-SU-2019:0726-1SUSE-SU-2019:0740-1SUSE-SU-2019:0745-1SUSE-SU-2019:0754-1SUSE-SU-2019:0765-1SUSE-SU-2019:0767-1SUSE-SU-2019:0784-1SUSE-SU-2019:0785-1SUSE-SU-2019:0828-1SUSE-SU-2019:0845-1SUSE-SU-2019:0901-1SUSE-SU-2019:1289-1USN-3930-2USN-3931-1USN-3931-2USN-3932-1USN-3932-2USN-3933-1
Timeline
- 15-02-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
CVSS metrics
5 scores · 3 sources · 3 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
High 8.1Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
16.52%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 16.52% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundLinux
Maturity: poc
Exploit Reference (bugs.chromium.org)
Maturity: unknown
Linux - 'kvm_ioctl_create_device()' NULL Pointer Dereference
Maturity: poc
Weaknesses
CWE · root cause- CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu20 products
- linux< 3.13.0-168.218 | < 4.4.0-145.171 | < 4.15.0-47.50
- linux-aws< 4.4.0-1040.43 | < 4.4.0-1079.89 | < 4.15.0-1035.37
- linux-aws-hwe< 4.15.0-1035.37~16.04.1
- linux-azure< 4.15.0-1041.45~14.04.1 | < 4.15.0-1041.45 | < 4.18.0-1014.14~18.04.1
- linux-azure-fdeAll versions (No fix recorded)
F512 products
- big-ip_access_policy_manager≥ 13.0.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | ≥ 15.0.0, < 15.1.0
- big-ip_advanced_firewall_manager≥ 13.0.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | ≥ 15.0.0, < 15.1.0
- big-ip_analytics≥ 13.0.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | ≥ 15.0.0, < 15.1.0
- big-ip_application_acceleration_manager≥ 13.0.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | ≥ 15.0.0, < 15.1.0
- big-ip_application_security_manager≥ 13.0.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | ≥ 15.0.0, < 15.1.0
Redhat9 products
- enterprise_linuxEOL7.0
- enterprise_linux_desktop7.0
- enterprise_linux_eus7.5
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.4 | 7.6
Debian2 products
- linux< 4.19.20-1
- debian_linuxEOL8.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 18.10
Linux1 product
- linux_kernel≥ 3.10, < 3.16.64 | ≥ 3.17, < 3.18.136 | ≥ 3.19, < 4.4.176 | ≥ 4.5, < 4.9.156 | ≥ 4.10, < 4.14.99 | ≥ 4.15, < 4.19.21 | ≥ 4.20, < 4.20.8
6 vendors · 45 products
References
39 links- bugs.chromium.org/p/project-zero/issues/detail?id=1765X Refsource MISCExploitMailing ListPatchThird Party Advisory
- github.com/torvalds/linux/commit/cfa39381173d5f969daf43582c95ad679189cbc9X Refsource MISCExploitPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2019/03/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 39 references
- lists.debian.org/debian-lts-announce/2019/04/msg00004.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/05/msg00002.htmlMailing ListX Refsource MLISTThird Party Advisory