PT-2019-4947 · Linux+6 · Linux Kernel+6

Robert Frohl · Published 2019-10-22 · Updated 2024-08-05 · CVE-2019-19046

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.3.11

Description The issue is related to a memory leak in the ipmi bmc register() function, which can be triggered by causing the ida simple get() function to fail. This can lead to a denial of service due to memory consumption. However, it is noted that third parties dispute the relevance of this issue because an attacker cannot realistically control this failure at probe time.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Leak

Resource Exhaustion

Weakness Enumeration

CWE-401

CWE-400

Related Identifiers

ALSA-2020:4431

ALT-PU-2019-3180

ALT-PU-2019-3184

ALT-PU-2019-3268

ALT-PU-2020-1198

ALT-PU-2020-1421

ALT-PU-2020-1450

ALT-PU-2020-1501

ALT-PU-2020-1714

ALT-PU-2020-2410

ALT-PU-2020-2433

ALT-PU-2021-1870

BDU:2020-01564

CESA-2020_4060

CESA-2020_4431

CESA-2020_4609

CVE-2019-19046

OPENSUSE-SU-2019:2675-1

OPENSUSE-SU-2019_2675-1

RHSA-2020:3545

RHSA-2020:4060

RHSA-2020:4062

RHSA-2020:4431

RHSA-2020:4609

RHSA-2020:5206

RHSA-2020:5656

RHSA-2020_4060

RHSA-2020_4062

RHSA-2020_4431

RHSA-2020_4609

SUSE-SU-2019:3200-1

SUSE-SU-2019:3317-1

SUSE-SU-2019:3372-1

SUSE-SU-2020:0093-1

SUSE-SU-2020:0613-1

USN-4302-1

USN-4319-1

USN-4325-1

Affected Products

Alt Linux

Almalinux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 658

• https://github.com/torvalds/linux/commit/4aa7afb0ee20a97fbf0c5bab3df028d5fb85fdab · Patch
• https://usn.ubuntu.com/4325-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4302-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8428 · Vendor Advisory
• https://usn.ubuntu.com/4302-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-19046 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15217 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19058 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19046 · Security Note
• https://linux.oracle.com/errata/ELSA-2020-4431.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3317-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2675-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html · Vendor Advisory