CVE-2019-19065: Medium severity Linux Linux kernel vulnerability
DISPUTED A memory leak in the sdmainit() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering rhashtableinit() failures, aka CID-34b3be18a04e. NOTE: This has been disputed as not a vulnerability because "rhashtableinit() can only fail if it is passed invalid values in the second parameter's struct, but when invoked from sdmainit() that is a pointer to a static const struct, so an attacker could only trigger failure if they could corrupt kernel memory (in which case a small memory leak is not a significant problem)."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19065?
The severity of CVE-2019-19065 is currently disputed and has been noted for potentially causing a denial of service due to a memory leak.
What versions of the Linux kernel are affected by CVE-2019-19065?
CVE-2019-19065 affects Linux kernel versions prior to 5.3.9.
How do I fix CVE-2019-19065?
To fix CVE-2019-19065, upgrade the Linux kernel to version 5.3.9 or later.
Which operating systems are affected by CVE-2019-19065?
CVE-2019-19065 affects various versions of the Linux kernel including Ubuntu 16.04, 18.04, 19.04, 19.10, and openSUSE Leap 15.1.
What is the impact of CVE-2019-19065 on system performance?
The impact of CVE-2019-19065 may lead to increased memory consumption and eventual denial of service due to rhashtable_init() failures.