CVE-2019-11486: Race Condition

Published Apr 23, 2019
ยท
Updated

The Siemens R3964 line discipline driver in drivers/tty/nr3964.c in the Linux kernel before 5.0.8 has multiple race conditions.

Affected Software

59 affected componentsFixes available
Linux Linux kernel<3.16.66
Linux Linux kernel>=3.17<3.18.139
Linux Linux kernel>=3.19<4.4.179
Linux Linux kernel>=4.5<4.9.169
Linux Linux kernel>=4.10<4.14.112
Linux Linux kernel>=4.15<4.19.35
Linux Linux kernel>=4.20<5.0.8
Debian Debian Linux=9.0
openSUSE Leap=15.1
openSUSE Leap=42.3
NetApp Active Iq
NetApp Hci Management Node
NetApp Snapprotect
NetApp Solidfire
NetApp Storage Replication Adapter For Clustered Data Ontap Vmware Vsphere=9.7
NetApp Vasa Provider For Clustered Data Ontap=9.7
NetApp Virtual Storage Console Vmware Vsphere=9.7
debian/linux
6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.3-1
ubuntu/linux-aws<4.4.0-1054.58
4.4.0-1054.58
ubuntu/linux-azure<4.15.0-1059.64~14.04.1
4.15.0-1059.64~14.04.1
ubuntu/linux-lts-xenial<4.4.0-164.192~14.04.1
4.4.0-164.192~14.04.1
ubuntu/linux*
ubuntu/linux<4.4.0-150.176
4.4.0-150.176
ubuntu/linux-aws<4.4.0-1084.94
4.4.0-1084.94
ubuntu/linux-aws-hwe<4.15.0-1047.49~16.04.1
4.15.0-1047.49~16.04.1
ubuntu/linux-azure<4.15.0-1056.61
4.15.0-1056.61
ubuntu/linux-gcp<4.15.0-1041.43
4.15.0-1041.43
ubuntu/linux-hwe<4.15.0-60.67~16.04.1
4.15.0-60.67~16.04.1
ubuntu/linux-kvm<4.4.0-1047.53
4.4.0-1047.53
ubuntu/linux-oracle<4.15.0-1022.25~16.04.1
4.15.0-1022.25~16.04.1
ubuntu/linux-raspi2<4.4.0-1110.118
4.4.0-1110.118
ubuntu/linux-snapdragon<4.4.0-1114.119
4.4.0-1114.119
ubuntu/linux-fips<4.4.0-1011.14
4.4.0-1011.14
ubuntu/linux<4.15.0-60.67
4.15.0-60.67
ubuntu/linux-aws<4.15.0-1047.49
4.15.0-1047.49
ubuntu/linux-azure<5.0.0-1014.14~18.04.1
5.0.0-1014.14~18.04.1
ubuntu/linux-gcp<4.15.0-1042.45
4.15.0-1042.45
ubuntu/linux-gke-4.15<4.15.0-1041.43
4.15.0-1041.43
ubuntu/linux-hwe<5.0.0-23.24~18.04.1
5.0.0-23.24~18.04.1
ubuntu/linux-hwe-edge<5.0.0-16.17~18.04.1
5.0.0-16.17~18.04.1
ubuntu/linux-kvm<4.15.0-1043.43
4.15.0-1043.43
ubuntu/linux-oem<4.15.0-1056.65
4.15.0-1056.65
ubuntu/linux-oracle<4.15.0-1022.25
4.15.0-1022.25
ubuntu/linux-raspi2<4.15.0-1044.47
4.15.0-1044.47
ubuntu/linux-snapdragon<4.15.0-1062.69
4.15.0-1062.69
ubuntu/linux-aws-fips<4.15.0-2018.18
4.15.0-2018.18
ubuntu/linux-azure-fips<4.15.0-2006.7
4.15.0-2006.7
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-azure-fde*
ubuntu/linux-gke*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1054.58
  2. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1059.64~14.04.1
  3. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-164.192~14.04.1
  4. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-150.176
  5. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1084.94
  6. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1047.49~16.04.1
  7. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1056.61
  8. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1041.43
  9. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-60.67~16.04.1
  10. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1047.53
  11. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1022.25~16.04.1
  12. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.4.0-1110.118
  13. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.4.0-1114.119
  14. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1011.14
  15. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-60.67
  16. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1047.49
  17. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.0.0-1014.14~18.04.1
  18. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1042.45
  19. Upgrade

    Upgrade ubuntu/linux-gke-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1041.43
  20. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 5.0.0-23.24~18.04.1
  21. Upgrade

    Upgrade ubuntu/linux-hwe-edge to a version that resolves this vulnerability.

    Fixed in 5.0.0-16.17~18.04.1
  22. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1043.43
  23. Upgrade

    Upgrade ubuntu/linux-oem to a version that resolves this vulnerability.

    Fixed in 4.15.0-1056.65
  24. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1022.25
  25. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1044.47
  26. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.15.0-1062.69
  27. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2018.18
  28. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2006.7
  29. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1

Event History

Apr 23, 2019
CVE Published
via MITREยท10:00 PM
Data Sourced
via MITREยท10:00 PM
Description
Data Sourced
via OSVยท10:29 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the vulnerability ID of this security issue?

The vulnerability ID of this security issue is CVE-2019-11486.

2

What is the severity level of CVE-2019-11486?

The severity level of CVE-2019-11486 is high with a severity value of 7.

3

Which software and versions are affected by CVE-2019-11486?

The Linux kernel versions before 5.0.8 and certain versions of Debian, openSUSE Leap, Netapp Active Iq, Netapp Hci Management Node, Netapp Snapprotect, Netapp Solidfire, Netapp Storage Replication Adapter For Clustered Data Ontap, Netapp Vasa Provider For Clustered Data Ontap, and Netapp Virtual Storage Console are affected. Please refer to the vulnerability description for specific version details.

4

How severe is the race condition vulnerability in the Siemens R3964 line discipline driver?

The race condition vulnerability in the Siemens R3964 line discipline driver is considered high severity.

5

How can I fix CVE-2019-11486?

To fix CVE-2019-11486, update to Linux kernel version 5.0.8 or later, or apply the appropriate security patches provided by your software vendor.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
ยฉ 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203