CVE-2019-3874: Medium severity Linux Linux kernel vulnerability
It was found that the cgroup limitation of system resources used by Kubernetes can be bypassed. A guest pod can be used to consume a large amount of system memory.
A suggested upstream patch set:
https://lore.kernel.org/netdev/20190401113110.GA20717@hmswarspite.think-freely.org/T/#u
Other sources
The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.rt24.93.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Configuration
If SELinux is not used, or if Security Context Constraint allows running pods as root, blacklist the 'sctp' kernel module to mitigate the SCTP socket buffer/cgroup accounting issue.
Linux kernel (modules) Blacklist kernel module = sctp
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-3874?
CVE-2019-3874 has been classified as a medium severity vulnerability due to its potential to allow resource consumption beyond intended limits.
How do I fix CVE-2019-3874?
To mitigate CVE-2019-3874, update your kernel to version 4.18.0-147.rt24.93.el8 or later.
What systems are affected by CVE-2019-3874?
CVE-2019-3874 affects certain versions of the Linux kernel and Kubernetes running on various distributions like Red Hat, Ubuntu, and Debian.
How does CVE-2019-3874 exploit Kubernetes?
CVE-2019-3874 allows a guest pod to bypass cgroup restrictions, leading to uncontrolled memory usage in the host system.
What are the recommended actions to secure against CVE-2019-3874?
It is recommended to apply the latest kernel patches and updates from your distribution to remediate CVE-2019-3874.