PT-2019-5138 · Libslirp+8 · Libslirp+8

Published 2019-08-25 · Updated 2024-06-15 · CVE-2019-15890

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions QEMU version 4.1.0 libslirp version 4.0.0

Description The issue is related to a use-after-free in the ip reass function in ip input.c, which can lead to a denial of service. This can be exploited by a remote attacker.

Recommendations For QEMU version 4.1.0, consider disabling the ip reass function as a temporary workaround until a patch is available. For libslirp version 4.0.0, restrict access to the ip input.c module to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2020:0348

ALSA-2020:4676

ALT-PU-2019-3257

ALT-PU-2019-3286

BDU:2020-01805

CESA-2020_0348

CESA-2020_0775

CESA-2020_4676

CVE-2019-15890

DLA-1927-1

DSA-4616-1

OPENSUSE-SU-2019:2510-1

OPENSUSE-SU-2019_2510-1

OPENSUSE-SU-2021:1043-1

OPENSUSE-SU-2021:1942-1

OPENSUSE-SU-2021_1043-1

OPENSUSE-SU-2021_1942-1

OPENSUSE-SU-2024:11287-1

RHSA-2020:0348

RHSA-2020:0775

RHSA-2020:0889

RHSA-2020:4676

RHSA-2020_0348

RHSA-2020_0775

RHSA-2020_4676

RLSA-2020:0348

RLSA-2020:4676

SUSE-SU-2019:14199-1

SUSE-SU-2019:14201-1

SUSE-SU-2019:2753-1

SUSE-SU-2019:2769-1

SUSE-SU-2019:2783-1

SUSE-SU-2019:2955-1

SUSE-SU-2019_14199-1

SUSE-SU-2020:0388-1

SUSE-SU-2020:14396-1

SUSE-SU-2020:1514-1

SUSE-SU-2020:1526-1

SUSE-SU-2020:1538-1

SUSE-SU-2020_1514-1

SUSE-SU-2020_1526-1

SUSE-SU-2020_1538-1

SUSE-SU-2021:14706-1

SUSE-SU-2021:1829-1

SUSE-SU-2021:1837-1

SUSE-SU-2021:1893-1

SUSE-SU-2021:1894-1

SUSE-SU-2021:1895-1

SUSE-SU-2021:1918-1

SUSE-SU-2021:1942-1

SUSE-SU-2021:1947-1

SUSE-SU-2021_1829-1

SUSE-SU-2021_1837-1

SUSE-SU-2021_1893-1

SUSE-SU-2021_1894-1

SUSE-SU-2021_1895-1

SUSE-SU-2021_1918-1

SUSE-SU-2021_1942-1

SUSE-SU-2021_1947-1

USN-4191-1

USN-4191-2

Affected Products

Alt Linux

Almalinux

Centos

Qemu

Red Hat

Rocky Linux

Suse

Ubuntu

Libslirp

References · 562

• https://osv.dev/vulnerability/SUSE-SU-2021:14706-1 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/09/06/3 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2019:2783-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/629847 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00130 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/648015 · Security Note
• https://ubuntu.com/security/CVE-2019-12155 · Vendor Advisory
• https://usn.ubuntu.com/4191-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4191-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15890 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1927-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01485 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20485 · Security Note
• https://errata.rockylinux.org/RLSA-2020:4676 · Vendor Advisory