CVE-2019-7221: canonical ubuntu_linux Use After Free
Modified
AliasesUBUNTU-CVE-2019-7221DEBIAN-CVE-2019-7221
Published 17-03-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-7221 is a high (CVSS 7.8) Use After Free vulnerability in canonical ubuntu_linux. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56.7% of scored vulnerabilities. 1 public exploit is recorded.
Priority
Prioritisepublic exploit
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?CVSS score
7.8/10
010
High · v3.0 (NVD)EPSS score
0.80%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 35 · Related 26DLA-1731-1DLA-1771-1MGASA-2019-0097MGASA-2019-0098MGASA-2019-0171OPENSUSE-SU-2019:0203-1OPENSUSE-SU-2024:10728-1OPENSUSE-SU-2024:13704-1RHSA-2019:0818RHSA-2019:0833RHSA-2019:3967RHSA-2019:4058SUSE-SU-2019:0541-1SUSE-SU-2019:0645-1SUSE-SU-2019:0672-1SUSE-SU-2019:0683-1SUSE-SU-2019:0709-1SUSE-SU-2019:0722-1SUSE-SU-2019:0726-1SUSE-SU-2019:0740-1SUSE-SU-2019:0745-1SUSE-SU-2019:0754-1SUSE-SU-2019:0765-1SUSE-SU-2019:0767-1SUSE-SU-2019:0784-1SUSE-SU-2019:0785-1SUSE-SU-2019:0828-1SUSE-SU-2019:0845-1SUSE-SU-2019:0901-1SUSE-SU-2019:1289-1USN-3930-2USN-3931-1USN-3931-2USN-3932-1USN-3932-2
Timeline
- 17-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 4.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.80% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugs.chromium.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu20 products
- linux< 4.4.0-145.171 | < 4.15.0-47.50
- linux-aws< 4.4.0-1040.43 | < 4.4.0-1079.89 | < 4.15.0-1035.37
- linux-aws-hwe< 4.15.0-1035.37~16.04.1
- linux-azure< 4.15.0-1041.45~14.04.1 | < 4.15.0-1041.45 | < 4.18.0-1014.14~18.04.1
- linux-azure-fdeAll versions (No fix recorded)
Redhat8 products
- enterprise_linuxEOL7.0
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.6
- enterprise_linux_server_eus7.6
Debian2 products
- linux< 4.19.20-1
- debian_linuxEOL8.0
Netapp2 products
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Fedoraproject1 product
- fedoraEOL28 | 29
Linux1 product
- linux_kernel≤ 4.20.5
Opensuse1 product
- leapEOL15.0
8 vendors · 36 products
References
33 links- packetstormsecurity.com/files/151713/KVM-VMX-Preemption-Timer-Use-After-Free.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2019-02/msg00042.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2019/02/18/2X Refsource MISCMailing ListPatchThird Party Advisory
- bugs.chromium.org/p/project-zero/issues/detail?id=1760X Refsource CONFIRMExploitPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2019/03/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2019/04/msg00004.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 33 references
- lists.debian.org/debian-lts-announce/2019/05/msg00002.htmlMailing ListX Refsource MLISTThird Party Advisory
- support.f5.com/csp/article/K08413011X Refsource CONFIRM