PT-2019-3613 · Linux+2 · Linux Kernel+2
Publicado
2019-10-01
·
Atualizado
2023-10-03
·
CVE-2019-17075
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 5.3.2
Description
An issue was discovered in the
write tpt entry function in drivers/infiniband/hw/cxgb4/mem.c. The cxgb4 driver is directly calling dma map single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance. The issue is also described as a buffer overflow in memory, which could allow a remote attacker to cause a denial of service.Recommendations
For Linux kernel versions through 5.3.2, consider disabling the
cxgb4 driver or restricting its use until a patch is available. As a temporary workaround, avoid using the dma map single function from stack variables in the write tpt entry function. However, since the exact steps to apply these workarounds are not specified and may require technical expertise, it is recommended to wait for an official patch. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Linux Kernel
Ubuntu