CVE-2019-14835: Buffer Overflow
First published: Tue Sep 10 2019(Updated: )
A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <0:2.6.32-754.23.1.el6 | 0:2.6.32-754.23.1.el6 |
| redhat/kernel | <0:2.6.32-431.96.2.el6 | 0:2.6.32-431.96.2.el6 |
| redhat/kernel | <0:2.6.32-504.81.2.el6 | 0:2.6.32-504.81.2.el6 |
| redhat/kernel-rt | <0:3.10.0-1062.1.2.rt56.1025.el7 | 0:3.10.0-1062.1.2.rt56.1025.el7 |
| redhat/kernel | <0:3.10.0-1062.1.2.el7 | 0:3.10.0-1062.1.2.el7 |
| redhat/kernel-alt | <0:4.14.0-115.13.1.el7a | 0:4.14.0-115.13.1.el7a |
| redhat/kernel | <0:3.10.0-327.82.1.el7 | 0:3.10.0-327.82.1.el7 |
| redhat/kernel | <0:3.10.0-514.69.1.el7 | 0:3.10.0-514.69.1.el7 |
| redhat/kernel | <0:3.10.0-693.59.1.el7 | 0:3.10.0-693.59.1.el7 |
| redhat/kernel | <0:3.10.0-862.41.2.el7 | 0:3.10.0-862.41.2.el7 |
| redhat/kernel | <0:3.10.0-957.35.2.el7 | 0:3.10.0-957.35.2.el7 |
| redhat/kernel-rt | <0:4.18.0-80.11.2.rt9.157.el8_0 | 0:4.18.0-80.11.2.rt9.157.el8_0 |
| redhat/kernel | <0:4.18.0-80.11.2.el8_0 | 0:4.18.0-80.11.2.el8_0 |
| redhat/redhat-virtualization-host | <0:4.2-20190919.0.el7_6 | 0:4.2-20190919.0.el7_6 |
| redhat/redhat-virtualization-host | <0:4.3.5-20190920.0.el7_7 | 0:4.3.5-20190920.0.el7_7 |
| debian/linux | 5.10.223-1 6.1.106-3 6.1.99-1 6.10.9-1 | |
| Linux Kernel | >=2.6.34<3.16.74 | |
| Linux Kernel | >=4.4<4.4.193 | |
| Linux Kernel | >=4.9<4.9.193 | |
| Linux Kernel | >=4.14<4.14.144 | |
| Linux Kernel | >=4.19<4.19.73 | |
| Linux Kernel | >=5.2<5.2.15 | |
| Linux Kernel | =5.3 | |
| Ubuntu | =12.04 | |
| Ubuntu | =14.04 | |
| Ubuntu | =16.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =19.04 | |
| Debian Linux | =8.0 | |
| Debian Linux | =9.0 | |
| Debian Linux | =10.0 | |
| Red Hat Fedora | =29 | |
| Red Hat Fedora | =30 | |
| SUSE Linux | =15.0 | |
| SUSE Linux | =15.1 | |
| All of | ||
| NetApp A700 Firmware | ||
| NetApp AFF A700s Firmware | ||
| All of | ||
| NetApp H410C | ||
| NetApp H410C Firmware | ||
| All of | ||
| NetApp HCI H610S Firmware | ||
| NetApp H610S Firmware | ||
| All of | ||
| NetApp H300S Firmware | ||
| NetApp H300S Firmware | ||
| All of | ||
| NetApp H500e Firmware | ||
| NetApp H500e Firmware | ||
| All of | ||
| NetApp H700S | ||
| NetApp H700S | ||
| All of | ||
| NetApp H300E | ||
| NetApp H300E Firmware | ||
| All of | ||
| NetApp H500S Firmware | ||
| NetApp H500e Firmware | ||
| All of | ||
| NetApp H700E | ||
| NetApp H700E | ||
| All of | ||
| NetApp H410S | ||
| NetApp H410S Firmware | ||
| NetApp Data Availability Services | ||
| NetApp SolidFire & HCI Management Node | ||
| NetApp Service Processor | ||
| NetApp SolidFire & HCI Storage Node | ||
| NetApp SteelStore Cloud Integrated Storage | ||
| Red Hat OpenShift Container Platform | =3.11 | |
| Red Hat Enterprise Linux | =8.0 | |
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server EUS | =7.5 | |
| Red Hat Enterprise Linux Server EUS | =7.6 | |
| Red Hat Enterprise Linux Server EUS | =7.7 | |
| Red Hat Enterprise Linux for Real Time | =7 | |
| Red Hat Enterprise Linux for Real Time | =8 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =6.5 | |
| Red Hat Enterprise Linux Server | =6.6 | |
| Red Hat Enterprise Linux Server | =7.2 | |
| Red Hat Enterprise Linux Server | =7.3 | |
| Red Hat Enterprise Linux Server | =7.4 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.7 | |
| Red Hat Enterprise Linux Server | =7.2 | |
| Red Hat Enterprise Linux Server | =7.3 | |
| Red Hat Enterprise Linux Server | =7.4 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.7 | |
| Red Hat Enterprise Linux Workstation | =6.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 | |
| All of | ||
| Any of | ||
| Red Hat Enterprise Virtualization | =4.0 | |
| Red Hat Virtualization Host EUS | =4.0 | |
| Red Hat Enterprise Linux | =7.0 | |
| Huawei iManager NetEco | =v600r009c00 | |
| Huawei iManager NetEco | =v600r009c10spc200 | |
| Huawei iManager NetEco 6000 Firmware | =v600r008c10spc300 | |
| Huawei iManager NetEco 6000 Firmware | =v600r008c20 | |
| Huawei ManageOne | =6.5.0 | |
| Huawei ManageOne | =6.5.0.spc100.b210 | |
| Huawei ManageOne | =6.5.1rc1.b060 | |
| Huawei ManageOne | =6.5.1rc1.b080 | |
| Huawei ManageOne | =6.5.rc2.b050 | |
| NetApp A700 Firmware | ||
| NetApp AFF A700s Firmware | ||
| NetApp H410C | ||
| NetApp H410C Firmware | ||
| NetApp HCI H610S Firmware | ||
| NetApp H610S Firmware | ||
| NetApp H300S Firmware | ||
| NetApp H300S Firmware | ||
| NetApp H500e Firmware | ||
| NetApp H500e Firmware | ||
| NetApp H700S | ||
| NetApp H700S | ||
| NetApp H300E | ||
| NetApp H300E Firmware | ||
| NetApp H500S Firmware | ||
| NetApp H500e Firmware | ||
| NetApp H700E | ||
| NetApp H700E | ||
| NetApp H410S | ||
| NetApp H410S Firmware | ||
| NetApp SteelStore Cloud Integrated Storage | ||
| Red Hat Enterprise Virtualization | =4.0 | |
| Red Hat Virtualization Host EUS | =4.0 | |
| Red Hat Enterprise Linux | =7.0 |
Remedy
For mitigation related information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/security/vulnerabilities/kernel-vhost
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2019-14835 https://nvd.nist.gov/vuln/detail/CVE-2019-14835 https://access.redhat.com/security/vulnerabilities/kernel-vhost https://www.openwall.com/lists/oss-security/2019/09/17/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1750727
- https://access.redhat.com/errata/RHSA-2019:2863
- https://access.redhat.com/errata/RHSA-2019:2901
- https://access.redhat.com/errata/RHSA-2019:2869
- https://access.redhat.com/errata/RHSA-2019:2830
- https://access.redhat.com/errata/RHSA-2019:2829
- https://access.redhat.com/errata/RHSA-2019:2854
- https://access.redhat.com/errata/RHSA-2019:2862
- https://access.redhat.com/errata/RHSA-2019:2899
- https://access.redhat.com/errata/RHSA-2019:2900
- https://access.redhat.com/errata/RHSA-2019:2867
- https://access.redhat.com/errata/RHSA-2019:2866
- https://access.redhat.com/errata/RHSA-2019:2864
- https://access.redhat.com/errata/RHSA-2019:2865
- https://access.redhat.com/errata/RHSA-2019:2828
- https://access.redhat.com/errata/RHSA-2019:2827
- https://access.redhat.com/errata/RHSA-2019:2924
- https://access.redhat.com/errata/RHSA-2019:2889
- https://access.redhat.com/security/cve/cve-2019-14835
- https://www.openwall.com/lists/oss-security/2019/09/17/1
- http://packetstormsecurity.com/files/154572/Kernel-Live-Patch-Security-Notice-LSN-0056-1.html
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
- http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- https://seclists.org/bugtraq/2019/Sep/41
- https://seclists.org/bugtraq/2019/Nov/11
- https://www.debian.org/security/2019/dsa-4531
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQFY6JYFIQ2VFQ7QCSXPWTUL5ZDNCJL5/
- https://access.redhat.com/errata/RHBA-2019:2824
- https://usn.ubuntu.com/4135-1/
- https://usn.ubuntu.com/4135-2/
- https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html
- https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html
- http://www.openwall.com/lists/oss-security/2019/09/24/1
- http://www.openwall.com/lists/oss-security/2019/10/03/1
- http://www.openwall.com/lists/oss-security/2019/10/09/3
- http://www.openwall.com/lists/oss-security/2019/10/09/7
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-qemu-en
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14835
- https://security.netapp.com/advisory/ntap-20191031-0005/
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
- https://launchpad.net/bugs/cve/CVE-2019-14835
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=060423bfdee3f8bc6e2c1bac97de24d5415e2bc4
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1752794
- https://access.redhat.com/security/vulnerabilities/kernel-vhost
- https://git.kernel.org/linus/060423bfdee3f8bc6e2c1bac97de24d5415e2bc4
- https://security-tracker.debian.org/tracker/CVE-2019-14835
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14835
- https://nvd.nist.gov/vuln/detail/CVE-2019-14835
- https://ubuntu.com/security/CVE-2019-14835
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2019-14835?
CVE-2019-14835 is a buffer overflow vulnerability found in the Linux kernel's vhost functionality.
How does CVE-2019-14835 affect Linux?
CVE-2019-14835 allows privileged guest users to exploit a buffer overflow flaw in the vhost functionality of the Linux kernel.
What is the severity of CVE-2019-14835?
CVE-2019-14835 has a severity level of high.
How can I fix CVE-2019-14835?
To fix CVE-2019-14835, it is recommended to update your Linux kernel to a version that includes the patch for the vulnerability.
Where can I find more information about CVE-2019-14835?
You can find more information about CVE-2019-14835 on the official Red Hat Security Advisory and the Git repository for the Linux kernel.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-14835
- agent/weakness
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/remedy
- agent/event
- agent/description
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- package-manager/redhat
- package-manager/debian
- vendor/linux
- canonical/linux kernel
- version/linux kernel/2.6.34
- version/linux kernel/4.4
- version/linux kernel/4.9
- version/linux kernel/4.14
- version/linux kernel/4.19
- version/linux kernel/5.2
- version/linux kernel/5.3
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/12.04
- version/ubuntu/14.04
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/19.04
- vendor/debian
- canonical/debian linux
- version/debian linux/8.0
- version/debian linux/9.0
- version/debian linux/10.0
- vendor/fedoraproject
- canonical/red hat fedora
- version/red hat fedora/29
- version/red hat fedora/30
- vendor/opensuse
- canonical/suse linux
- version/suse linux/15.0
- version/suse linux/15.1
- vendor/netapp
- canonical/netapp a700 firmware
- canonical/netapp aff a700s firmware
- canonical/netapp h410c
- canonical/netapp h410c firmware
- canonical/netapp hci h610s firmware
- canonical/netapp h610s firmware
- canonical/netapp h300s firmware
- canonical/netapp h500e firmware
- canonical/netapp h700s
- canonical/netapp h300e
- canonical/netapp h300e firmware
- canonical/netapp h500s firmware
- canonical/netapp h700e
- canonical/netapp h410s
- canonical/netapp h410s firmware
- canonical/netapp data availability services
- canonical/netapp solidfire & hci management node
- canonical/netapp service processor
- canonical/netapp solidfire & hci storage node
- canonical/netapp steelstore cloud integrated storage
- vendor/redhat
- canonical/red hat openshift container platform
- version/red hat openshift container platform/3.11
- canonical/red hat enterprise linux
- version/red hat enterprise linux/8.0
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server eus
- version/red hat enterprise linux server eus/7.5
- version/red hat enterprise linux server eus/7.6
- version/red hat enterprise linux server eus/7.7
- canonical/red hat enterprise linux for real time
- version/red hat enterprise linux for real time/7
- version/red hat enterprise linux for real time/8
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/7.6
- version/red hat enterprise linux server/6.5
- version/red hat enterprise linux server/6.6
- version/red hat enterprise linux server/7.2
- version/red hat enterprise linux server/7.3
- version/red hat enterprise linux server/7.4
- version/red hat enterprise linux server/7.7
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0
- version/red hat enterprise linux workstation/7.0
- canonical/red hat enterprise virtualization
- version/red hat enterprise virtualization/4.0
- canonical/red hat virtualization host eus
- version/red hat virtualization host eus/4.0
- version/red hat enterprise linux/7.0
- vendor/huawei
- canonical/huawei imanager neteco
- version/huawei imanager neteco/v600r009c00
- version/huawei imanager neteco/v600r009c10spc200
- canonical/huawei imanager neteco 6000 firmware
- version/huawei imanager neteco 6000 firmware/v600r008c10spc300
- version/huawei imanager neteco 6000 firmware/v600r008c20
- canonical/huawei manageone
- version/huawei manageone/6.5.0
- version/huawei manageone/6.5.0.spc100.b210
- version/huawei manageone/6.5.1rc1.b060
- version/huawei manageone/6.5.1rc1.b080
- version/huawei manageone/6.5.rc2.b050