CVE-2019-11815: Race Condition

Published May 8, 2019
·
Updated

An issue was discovered in rdstcpkillsock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.

Affected Software

73 affected componentsFixes available
debian/linux<=4.9.168-2, <=4.19.28-2, <=3.16.64-2, <=4.9.168-1
4.19.37-14.9.168-1+deb9u3
Linux Linux kernel>=4.3<4.4.179
Linux Linux kernel>=4.9<4.9.169
Linux Linux kernel>=4.14<4.14.112
Linux Linux kernel>=4.19<4.19.35
Linux Linux kernel>=5.0<5.0.8
Linux Linux kernel=5.1-rc1
Linux Linux kernel=5.1-rc2
Linux Linux kernel=5.1-rc3
Linux Linux kernel=5.1-rc4
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.04
Debian Debian Linux=8.0
Debian Debian Linux=9.0
openSUSE Leap=15.0
openSUSE Leap=15.1
openSUSE Leap=42.3
NetApp Active Iq Unified Manager Vmware Vsphere>=9.5
NetApp Hci Management Node
NetApp Snapprotect
NetApp Solidfire
NetApp Storage Replication Adapter Vsphere=7.2
NetApp Vasa Provider For Clustered Data Ontap>=7.2
NetApp Virtual Storage Console Vsphere>=7.2
NetApp Hci Compute Node
NetApp Hci Storage Node
NetApp Cn1610 Firmware
NetApp Cn1610
All of the following
NetApp Cn1610 Firmware
NetApp Cn1610
debian/linux
6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.3-1
ubuntu/linux-aws<4.4.0-1054.58
4.4.0-1054.58
ubuntu/linux-azure<4.15.0-1059.64~14.04.1
4.15.0-1059.64~14.04.1
ubuntu/linux-lts-xenial<4.4.0-164.192~14.04.1
4.4.0-164.192~14.04.1
ubuntu/linux<4.4.0-150.176
4.4.0-150.176
ubuntu/linux-aws<4.4.0-1084.94
4.4.0-1084.94
ubuntu/linux-aws-hwe<4.15.0-1047.49~16.04.1
4.15.0-1047.49~16.04.1
ubuntu/linux-azure<4.15.0-1051.56
4.15.0-1051.56
ubuntu/linux-gcp<4.15.0-1037.39~16.04.1
4.15.0-1037.39~16.04.1
ubuntu/linux-hwe<4.15.0-55.60~16.04.2
4.15.0-55.60~16.04.2
ubuntu/linux-kvm<4.4.0-1047.53
4.4.0-1047.53
ubuntu/linux-oracle<4.15.0-1018.20~16.04.1
4.15.0-1018.20~16.04.1
ubuntu/linux-raspi2<4.4.0-1110.118
4.4.0-1110.118
ubuntu/linux-snapdragon<4.4.0-1114.119
4.4.0-1114.119
ubuntu/linux-fips<4.4.0-1011.14
4.4.0-1011.14
ubuntu/linux<4.15.0-55.60
4.15.0-55.60
ubuntu/linux-aws<4.15.0-1047.49
4.15.0-1047.49
ubuntu/linux-azure<4.18.0-1025.27~18.04.1
4.18.0-1025.27~18.04.1
ubuntu/linux-gcp<4.15.0-1037.39
4.15.0-1037.39
ubuntu/linux-gke-4.15<4.15.0-1037.39
4.15.0-1037.39
ubuntu/linux-hwe<5.0.0-23.24~18.04.1
5.0.0-23.24~18.04.1
ubuntu/linux-hwe-edge<5.0.0-16.17~18.04.1
5.0.0-16.17~18.04.1
ubuntu/linux-kvm<4.15.0-1039.39
4.15.0-1039.39
ubuntu/linux-oem<4.15.0-1050.57
4.15.0-1050.57
ubuntu/linux-oracle<4.15.0-1018.20
4.15.0-1018.20
ubuntu/linux-raspi2<4.15.0-1041.44
4.15.0-1041.44
ubuntu/linux-snapdragon<4.15.0-1058.64
4.15.0-1058.64
ubuntu/linux-aws-fips<4.15.0-2018.18
4.15.0-2018.18
ubuntu/linux-azure-fips<4.15.0-2006.7
4.15.0-2006.7
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-azure-fde*
ubuntu/linux-gke*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 4.19.37-1Fixed in 4.9.168-1+deb9u3
  2. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
  3. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1054.58
  4. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1059.64~14.04.1
  5. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-164.192~14.04.1
  6. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-150.176
  7. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1084.94
  8. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1047.49~16.04.1
  9. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1051.56
  10. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1037.39~16.04.1
  11. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-55.60~16.04.2
  12. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1047.53
  13. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1018.20~16.04.1
  14. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.4.0-1110.118
  15. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.4.0-1114.119
  16. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1011.14
  17. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-55.60
  18. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1047.49
  19. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.18.0-1025.27~18.04.1
  20. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1037.39
  21. Upgrade

    Upgrade ubuntu/linux-gke-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1037.39
  22. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 5.0.0-23.24~18.04.1
  23. Upgrade

    Upgrade ubuntu/linux-hwe-edge to a version that resolves this vulnerability.

    Fixed in 5.0.0-16.17~18.04.1
  24. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1039.39
  25. Upgrade

    Upgrade ubuntu/linux-oem to a version that resolves this vulnerability.

    Fixed in 4.15.0-1050.57
  26. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1018.20
  27. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1041.44
  28. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.15.0-1058.64
  29. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2018.18
  30. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2006.7

Event History

May 8, 2019
CVE Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·01:36 PM
Data Sourced
via MITRE·01:36 PM
Description
Data Sourced
via NVD·02:29 PM
RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2019-11815?

CVE-2019-11815 is classified as a high severity vulnerability due to the potential for a use-after-free condition.

2

How do I fix CVE-2019-11815?

To fix CVE-2019-11815, update the Linux kernel to versions 5.0.8 or later, or the specific patched versions provided by your distribution.

3

What type of vulnerability is CVE-2019-11815?

CVE-2019-11815 is a vulnerability characterized as a race condition leading to a use-after-free in the Linux kernel.

4

Which systems are affected by CVE-2019-11815?

CVE-2019-11815 affects various versions of the Linux kernel before 5.0.8 and specific distributions such as Debian and Ubuntu.

5

What could an attacker exploit in CVE-2019-11815?

An attacker could exploit CVE-2019-11815 to execute arbitrary code or cause a denial of service due to the race condition in net namespace cleanup.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203