CVE-2019-19922: Medium severity Linux Linux kernel vulnerability

A flaw was found in the Linux kernels scheduler which can allow attackers to cause a denial of service against non-CPU-bound applications by generating a workload that triggers unwanted scheduling slice expiration. A local attacker who is able to trigger a specific workload type could abuse this technique to trigger a system to be seen as 'degraded' and possibly trigger workload-rebalance in systems that use slice-expiration metric as a measure of system health.

Reference: https://github.com/kubernetes/kubernetes/issues/67577

Reference and upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=de53fd7aedb100f03e5d2231cfce0e4993282425

— Red Hat

kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfsquotaus is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)