CVE-2019-3900
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:N/I:N/A:C
7.7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
8.4 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
46.7%
An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.
Affected configurations
CNA Affected
[
{
"product": "Kernel",
"vendor": "Red Hat",
"versions": [
{
"status": "affected",
"version": "affects up to and including v5.1-rc6"
}
]
}
]References
packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
www.securityfocus.com/bid/108076
access.redhat.com/errata/RHSA-2019:1973
access.redhat.com/errata/RHSA-2019:2029
access.redhat.com/errata/RHSA-2019:2043
access.redhat.com/errata/RHSA-2019:3220
access.redhat.com/errata/RHSA-2019:3309
access.redhat.com/errata/RHSA-2019:3517
access.redhat.com/errata/RHSA-2019:3836
access.redhat.com/errata/RHSA-2019:3967
access.redhat.com/errata/RHSA-2019:4058
access.redhat.com/errata/RHSA-2020:0204
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3900
lists.debian.org/debian-lts-announce/2019/08/msg00016.html
lists.debian.org/debian-lts-announce/2019/08/msg00017.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYTZH6QCNITK7353S6RCRT2PQHZSDPXD/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RI3WXXM5URTZSR3RVEKO6MDXDFIKTZ5R/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOFNJA5NNVXQ6AV6KGZB677JIVXAMJHT/
seclists.org/bugtraq/2019/Aug/18
seclists.org/bugtraq/2019/Nov/11
security.netapp.com/advisory/ntap-20190517-0005/
usn.ubuntu.com/4114-1/
usn.ubuntu.com/4115-1/
usn.ubuntu.com/4116-1/
usn.ubuntu.com/4117-1/
usn.ubuntu.com/4118-1/
www.debian.org/security/2019/dsa-4497
www.oracle.com/security-alerts/cpuApr2021.html
www.spinics.net/lists/kernel/msg3111012.html
Social References
More
Related
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:N/I:N/A:C
7.7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
8.4 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
46.7%