CVE-2019-9162: canonical ubuntu_linux Out-of-bounds Write
Vulnerability summary
CVE-2019-9162 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 64.9% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 25-02-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.09% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (bugs.chromium.org)
Maturity: unknown
Linux < 4.14.103 / < 4.19.25 - Out-of-Bounds Read and Write in SNMP NAT Module
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Netapp4 products
Ubuntu3 products
- linux-azure< 4.18.0-1014.14~18.04.1
- linux-gcp-edge< 4.18.0-1008.9~18.04.1
- linux-hwe< 4.18.0-17.18~18.04.1
Canonical1 product
- ubuntu_linuxEOL18.04 | 18.10
Debian1 product
- linux< 4.19.28-1
Linux1 product
- linux_kernel≥ 4.19, < 4.19.25 | ≥ 4.20, < 4.20.12
5 vendors · 10 products
References
16 links- github.com/torvalds/linux/commit/c4c07b4d6fa1f11880eab8e076d3d060ef3f55fcX Refsource MISCPatchThird Party Advisory
- bugs.chromium.org/p/project-zero/issues/detail?id=1776X Refsource MISCExploitIssue TrackingMailing ListThird Party Advisory
