CVE-2019-19332: Medium severity Linux Linux kernel vulnerability
An OOB memory write issue was found in the way Linux kernel's KVM hypervisor handled 'KVMGETEMULATEDCPUID' ioctl(2) request to get cpuid features emulated by the KVM hypervisor.
A user/process able to access '/dev/kvm' device could use this flaw to crash the system resulting in DoS issue.
Upstream patch: --------------- -> https://git.kernel.org/linus/433f4ba1904100da65a311033f17a9bf586b287e
Reference: -> https://lore.kernel.org/kvm/000000000000ea5ec20598d90e50@google.com/
Other sources
An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVMGETEMULATEDCPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service.
An out-of-bounds memory write issue was found in the way the Linux kernel's KVM hypervisor handled the 'KVMGETEMULATEDCPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.rt7.54.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-19332?
CVE-2019-19332 has a high severity rating, as it can allow a local user to crash the system, leading to a denial of service.
How do I fix CVE-2019-19332?
To fix CVE-2019-19332, update the Linux kernel to a version that addresses this vulnerability.
Which systems are affected by CVE-2019-19332?
CVE-2019-19332 affects various versions of the Linux kernel, including Red Hat Enterprise Linux 7 and 8, and specific kernel-rt packages.
Can CVE-2019-19332 be exploited remotely?
CVE-2019-19332 cannot be exploited remotely as it requires local access to the '/dev/kvm' device.
What impact does CVE-2019-19332 have on system stability?
CVE-2019-19332 can lead to system crashes, significantly impacting system stability and availability.