CVE-2019-3900
7.7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
7.9 High
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:N/I:N/A:C
0.001 Low
EPSS
Percentile
45.7%
An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.
References
packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
www.securityfocus.com/bid/108076
access.redhat.com/errata/RHSA-2019:1973
access.redhat.com/errata/RHSA-2019:2029
access.redhat.com/errata/RHSA-2019:2043
access.redhat.com/errata/RHSA-2019:3220
access.redhat.com/errata/RHSA-2019:3309
access.redhat.com/errata/RHSA-2019:3517
access.redhat.com/errata/RHSA-2019:3836
access.redhat.com/errata/RHSA-2019:3967
access.redhat.com/errata/RHSA-2019:4058
access.redhat.com/errata/RHSA-2020:0204
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3900
lists.debian.org/debian-lts-announce/2019/08/msg00016.html
lists.debian.org/debian-lts-announce/2019/08/msg00017.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYTZH6QCNITK7353S6RCRT2PQHZSDPXD/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RI3WXXM5URTZSR3RVEKO6MDXDFIKTZ5R/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOFNJA5NNVXQ6AV6KGZB677JIVXAMJHT/
seclists.org/bugtraq/2019/Aug/18
seclists.org/bugtraq/2019/Nov/11
security.netapp.com/advisory/ntap-20190517-0005/
usn.ubuntu.com/4114-1/
usn.ubuntu.com/4115-1/
usn.ubuntu.com/4116-1/
usn.ubuntu.com/4117-1/
usn.ubuntu.com/4118-1/
www.debian.org/security/2019/dsa-4497
www.oracle.com/security-alerts/cpuApr2021.html
www.spinics.net/lists/kernel/msg3111012.html
Social References
More
Related
7.7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
7.9 High
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:N/I:N/A:C
0.001 Low
EPSS
Percentile
45.7%