First published: Thu Aug 29 2019(Updated: )
An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/kernel | <0:2.6.32-754.25.1.el6 | 0:2.6.32-754.25.1.el6 |
redhat/kernel-rt | <0:3.10.0-1062.7.1.rt56.1030.el7 | 0:3.10.0-1062.7.1.rt56.1030.el7 |
redhat/kernel | <0:3.10.0-1062.7.1.el7 | 0:3.10.0-1062.7.1.el7 |
redhat/kernel-alt | <0:4.14.0-115.16.1.el7a | 0:4.14.0-115.16.1.el7a |
redhat/kernel | <0:3.10.0-957.56.1.el7 | 0:3.10.0-957.56.1.el7 |
redhat/kernel-rt | <0:4.18.0-147.rt24.93.el8 | 0:4.18.0-147.rt24.93.el8 |
redhat/kernel | <0:4.18.0-147.el8 | 0:4.18.0-147.el8 |
redhat/kernel | <0:4.18.0-80.15.1.el8_0 | 0:4.18.0-80.15.1.el8_0 |
Linux Kernel | >=2.6.27<=3.15.10 | |
Linux Kernel | >=3.16<3.16.74 | |
Linux Kernel | >=4.4<4.4.194 | |
Linux Kernel | >=4.9<4.9.194 | |
Linux Kernel | >=4.14<4.14.146 | |
Linux Kernel | >=4.19<4.19.75 | |
Linux Kernel | >=5.2<5.2.17 | |
Linux Kernel | >=5.3<5.3.1 | |
Linux Kernel | =5.4-rc1 | |
Red Hat Virtualization Host EUS | =4.0 | |
Red Hat Enterprise Linux | =8.0 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server EUS | =7.7 | |
Red Hat Enterprise Linux for Real Time | =7 | |
Red Hat Enterprise Linux for Real Time | =8 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =7.7 | |
Red Hat Enterprise Linux Server | =7.7 | |
Red Hat Enterprise Linux Workstation | =6.0 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
Ubuntu | =14.04 | |
Ubuntu | =16.04 | |
Ubuntu | =18.04 | |
Ubuntu | =19.04 | |
SUSE Linux | =15.0 | |
SUSE Linux | =15.1 | |
Red Hat Fedora | =29 | |
Red Hat Fedora | =30 | |
Debian Linux | =8.0 | |
Debian Linux | =9.0 | |
Debian Linux | =10.0 | |
All of | ||
NetApp A700 Firmware | ||
NetApp AFF A700s Firmware | ||
All of | ||
NetApp H300S Firmware | ||
NetApp H300S Firmware | ||
All of | ||
NetApp H500e Firmware | ||
NetApp H500e Firmware | ||
All of | ||
NetApp H700S | ||
NetApp H700S | ||
All of | ||
NetApp H300E | ||
NetApp H300E Firmware | ||
All of | ||
NetApp H500S Firmware | ||
NetApp H500e Firmware | ||
All of | ||
NetApp H700E | ||
NetApp H700E | ||
All of | ||
NetApp H410S | ||
NetApp H410S Firmware | ||
All of | ||
NetApp H410C | ||
NetApp H410C Firmware | ||
All of | ||
NetApp HCI H610S Firmware | ||
NetApp H610S Firmware | ||
NetApp Data Availability Services | ||
NetApp SolidFire & HCI Management Node | ||
NetApp SolidFire & HCI Storage Node | ||
Oracle SD-WAN Edge | =7.3 | |
Oracle SD-WAN Edge | =8.0 | |
Oracle SD-WAN Edge | =8.1 | |
Oracle SD-WAN Edge | =8.2 | |
NetApp A700 Firmware | ||
NetApp AFF A700s Firmware | ||
NetApp H300S Firmware | ||
NetApp H300S Firmware | ||
NetApp H500e Firmware | ||
NetApp H500e Firmware | ||
NetApp H700S | ||
NetApp H700S | ||
NetApp H300E | ||
NetApp H300E Firmware | ||
NetApp H500S Firmware | ||
NetApp H500e Firmware | ||
NetApp H700E | ||
NetApp H700E | ||
NetApp H410S | ||
NetApp H410S Firmware | ||
NetApp H410C | ||
NetApp H410C Firmware | ||
NetApp HCI H610S Firmware | ||
NetApp H610S Firmware | ||
debian/linux | 5.10.223-1 5.10.234-1 6.1.129-1 6.1.128-1 6.12.20-1 6.12.21-1 |
Restrict access to the '/dev/kvm' device to trusted users.
Ensure that untrusted users cannot write to the /dev/kvm device
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
CVE-2019-14821 is rated as high severity based on its impact on the security and stability of the Linux kernel.
To fix CVE-2019-14821, you should upgrade to a patched version of the kernel that addresses this vulnerability.
CVE-2019-14821 affects all versions of the Linux kernel up to 5.3.
CVE-2019-14821 may be exploited locally, but it is not typically considered a remote attack vulnerability.
CVE-2019-14821 specifically impacts the KVM hypervisor within the Linux kernel, particularly in its handling of Coalesced MMIO write operations.