CVE-2019-8980: High severity Linux Linux kernel vulnerability
A kernel memory leak was found in the kernelreadfile() function in the fs/exec.c file in the Linux kernel which allows attackers to cause a memory leak and thus a denial of service (DoS).
References:
https://lore.kernel.org/lkml/20190219021038.11340-1-yuehaibing@huawei.com/T/#u
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1935698.html
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f612acfae86af7ecad754ae6a46019be9da05b8e
Other sources
A kernel memory leak was found in the kernelreadfile() function in the fs/exec.c file in the Linux kernel. An attacker could use this flaw to cause a memory leak and thus a denial of service (DoS).
A memory leak in the kernelreadfile function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfsread failures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.rt13.51.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.12-1Fixed in 7.1.13-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-8980?
CVE-2019-8980 has a severity rating of medium due to its potential to cause a denial of service.
How do I fix CVE-2019-8980?
To fix CVE-2019-8980, update your kernel to versions 0:4.18.0-193.rt13.51.el8 or 0:4.18.0-193.el8 or later.
What systems are affected by CVE-2019-8980?
CVE-2019-8980 affects various Linux kernel versions between 4.7 and 5.1-rc1 and several Linux distributions like Red Hat, Ubuntu, and Debian.
Can CVE-2019-8980 be exploited remotely?
CVE-2019-8980 may allow local attackers to exploit the vulnerability to cause a memory leak.
What components are involved in CVE-2019-8980?
CVE-2019-8980 specifically involves the kernel_read_file() function within the fs/exec.c file of the Linux kernel.