Lucene search

K
nvd[email protected]NVD:CVE-2019-14821
HistorySep 19, 2019 - 6:15 p.m.

CVE-2019-14821

2019-09-1918:15:10
CWE-787
web.nvd.nist.gov

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

34.9%

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel’s KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer ‘struct kvm_coalesced_mmio’ object, wherein write indices ‘ring->first’ and ‘ring->last’ value could be supplied by a host user-space process. An unprivileged host user or process with access to ‘/dev/kvm’ device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

Affected configurations

NVD
Node
linuxlinux_kernelRange2.6.273.15.10
OR
linuxlinux_kernelRange3.163.16.74
OR
linuxlinux_kernelRange4.44.4.194
OR
linuxlinux_kernelRange4.94.9.194
OR
linuxlinux_kernelRange4.144.14.146
OR
linuxlinux_kernelRange4.194.19.75
OR
linuxlinux_kernelRange5.25.2.17
OR
linuxlinux_kernelRange5.35.3.1
OR
linuxlinux_kernelMatch5.4rc1
Node
redhatvirtualization_hostMatch4.0
OR
redhatenterprise_linuxMatch8.0
OR
redhatenterprise_linux_desktopMatch6.0
OR
redhatenterprise_linux_desktopMatch7.0
OR
redhatenterprise_linux_eusMatch7.7
OR
redhatenterprise_linux_for_real_timeMatch7
OR
redhatenterprise_linux_for_real_timeMatch8
OR
redhatenterprise_linux_serverMatch6.0
OR
redhatenterprise_linux_serverMatch7.0
OR
redhatenterprise_linux_server_ausMatch7.7
OR
redhatenterprise_linux_server_tusMatch7.7
OR
redhatenterprise_linux_workstationMatch6.0
OR
redhatenterprise_linux_workstationMatch7.0
Node
canonicalubuntu_linuxMatch14.04esm
OR
canonicalubuntu_linuxMatch16.04esm
OR
canonicalubuntu_linuxMatch18.04lts
OR
canonicalubuntu_linuxMatch19.04
Node
opensuseleapMatch15.0
OR
opensuseleapMatch15.1
Node
fedoraprojectfedoraMatch29
OR
fedoraprojectfedoraMatch30
Node
debiandebian_linuxMatch8.0
OR
debiandebian_linuxMatch9.0
OR
debiandebian_linuxMatch10.0
Node
netappaff_a700sMatch-
AND
netappaff_a700s_firmwareMatch-
Node
netapph300sMatch-
AND
netapph300s_firmwareMatch-
Node
netapph500sMatch-
AND
netapph500s_firmwareMatch-
Node
netapph700sMatch-
AND
netapph700s_firmwareMatch-
Node
netapph300eMatch-
AND
netapph300e_firmwareMatch-
Node
netapph500eMatch-
AND
netapph500e_firmwareMatch-
Node
netapph700e_firmwareMatch-
AND
netapph700eMatch-
Node
netapph410s_firmwareMatch-
AND
netapph410sMatch-
Node
netapph410c_firmwareMatch-
AND
netapph410cMatch-
Node
netapph610s_firmwareMatch-
AND
netapph610sMatch-
Node
netappdata_availability_servicesMatch-
OR
netapphci_management_nodeMatch-
OR
netappsolidfireMatch-
Node
oraclesd-wan_edgeMatch7.3
OR
oraclesd-wan_edgeMatch8.0
OR
oraclesd-wan_edgeMatch8.1
OR
oraclesd-wan_edgeMatch8.2

References

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

34.9%