PT-2019-5303 · Linux+1 · Linux Kernel+1
Pedro Sampaio
+1
·
Publicado
2019-04-11
·
Atualizado
2023-02-15
·
CVE-2019-3837
CVSS v3.1
6.1
Média
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel version 2.6.32
Description
The issue is related to the net dma code in the tcp recvmsg() function, which is thread-unsafe. This can be exploited by an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel on ioatdma-enabled hardware with net dma enabled, potentially leading to memory leaks, host crashes, denial-of-service, or random memory corruption.
Recommendations
For Linux kernel version 2.6.32, consider disabling the net dma code or restricting the use of the tcp recvmsg() function to minimize the risk of exploitation until a patch is available. Additionally, avoid using ioatdma-enabled hardware with net dma enabled for sensitive operations.
Correção
DoS
Memory Leak
Race Condition
Resource Exhaustion
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux Kernel
Suse