PT-2019-4415 · Linux+2 · Linux Kernel+2

Published 2019-09-27 · Updated 2024-08-05 · CVE-2019-19076

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.3.6

Description A memory leak in the nfp abm u32 knode replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c allows attackers to cause a denial of service (memory consumption). The issue has been argued as not a valid vulnerability, and the upstream commit was reverted.

Recommendations For Linux kernel versions prior to 5.3.6, update to version 5.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the nfp abm u32 knode replace() function until a patch is available.

Fix

DoS

Resource Exhaustion

Memory Leak

Weakness Enumeration

CWE-400

CWE-401

Related Identifiers

ALT-PU-2019-2900

ALT-PU-2019-2930

ALT-PU-2019-3061

ALT-PU-2020-1198

ALT-PU-2020-1329

ALT-PU-2020-1330

ALT-PU-2020-1398

ALT-PU-2020-1421

ALT-PU-2020-1450

ALT-PU-2020-1501

ALT-PU-2020-1524

ALT-PU-2020-1714

ALT-PU-2020-1945

ALT-PU-2020-2410

ALT-PU-2020-2433

ALT-PU-2020-3057

ALT-PU-2021-1745

ALT-PU-2021-1870

AZL-41940

BDU:2020-00158

CVE-2019-19076

USN-4209-1

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 26

• https://github.com/torvalds/linux/commit/78beef629fd95be4ed853b2d37b832f766bd96ca · Patch
• https://osv.dev/vulnerability/CVE-2019-19076 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-41940 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15794 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-19076 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.6 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19076 · Security Note
• https://usn.ubuntu.com/4209-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19076 · Vendor Advisory
• https://git.kernel.org/linus/1d1997db870f4058676439ef7014390ba9e24eb2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4209-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19076 · Security Note
• https://osv.dev/vulnerability/USN-4209-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19076 · Vendor Advisory