CVE-2019-3882: Medium severity Linux Linux kernel vulnerability
A flaw was found in the Linux kernel vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS).
References:
https://seclists.org/oss-sec/2019/q2/6
A suggested fix:
https://lore.kernel.org/lkml/155414977872.12780.13728555131525362206.stgit@gimli.home/T/#u
Other sources
A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.rt56.1022.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.rt24.93.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Compensating control
If a device is bound to a vfio driver (e.g., vfio-pci), restrict which local users can be administratively granted ownership of that device to prevent system memory exhaustion and DoS.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-3882?
CVE-2019-3882 is classified as a high severity vulnerability due to its potential to allow attackers to exhaust system memory.
How do I fix CVE-2019-3882?
To fix CVE-2019-3882, users should update to the recommended kernel version specified by their Linux distribution.
Who is affected by CVE-2019-3882?
CVE-2019-3882 affects users of the Linux kernel versions 3.10, 4.14, and 4.18, particularly those who use vfio drivers.
What type of attack does CVE-2019-3882 enable?
CVE-2019-3882 enables local attackers to bypass user memory limits through administrative privileges on vfio-bound devices.
What platforms are impacted by CVE-2019-3882?
CVE-2019-3882 impacts various Linux distributions that incorporate the affected kernel versions, including Red Hat, Debian, and Ubuntu.