CVE-2019-19080: Medium severity Linux Linux kernel vulnerability
Four memory leaks in the nfpflowerspawnphyreprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this denial-of-service issue?
Systems running a Linux kernel version before 5.3.4 are affected if the vulnerable Netronome Flower driver code is present and reachable. The listed affected software includes the Linux kernel and openSUSE Leap.
What does an attacker need to do to exploit the issue?
The CVSS vector indicates exploitation is network-accessible, requires no privileges or user interaction, but has high attack complexity. Successful exploitation causes memory consumption that can lead to denial of service; no confidentiality or integrity impact is indicated.
How can I remediate the vulnerability?
Apply the available patch, identified by commit 8572cea1461a006bce1d06c0c4b0575869125fa4. The issue is fixed in Linux kernel 5.3.4.