Linux Kernel up to 5.0.16 Freescale Hypervisor Manager Parameter integer overflow
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.7 | $0-$5k | 0.00 |
A vulnerability has been found in Linux Kernel (Operating System) and classified as critical. This vulnerability affects an unknown code of the component Freescale Hypervisor Manager. The manipulation as part of a Parameter leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:
A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system, corrupt memory, or create other adverse security affects.
The weakness was disclosed 07/30/2019 as not defined bug report (Bugzilla). The advisory is available at bugzilla.redhat.com. This vulnerability was named CVE-2019-10142 since 03/27/2019. Local access is required to approach this attack. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.
The commercial vulnerability scanner Qualys is able to test this issue with plugin 351582 (Amazon Linux Security Advisory for kernel: ALAS-2019-1214).
Upgrading to version 5.0.17 eliminates this vulnerability.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.7VulDB Meta Temp Score: 6.7
VulDB Base Score: 5.3
VulDB Temp Score: 5.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 7.8
NVD Vector: 🔍
CNA Base Score: 7.1
CNA Vector (Red Hat, Inc.): 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Integer overflowCWE: CWE-190 / CWE-189
CAPEC: 🔍
ATT&CK: 🔍
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Kernel 5.0.17
Timeline
03/27/2019 🔍07/30/2019 🔍
07/31/2019 🔍
06/27/2024 🔍
Sources
Vendor: kernel.orgAdvisory: bugzilla.redhat.com
Status: Not defined
Confirmation: 🔍
CVE: CVE-2019-10142 (🔍)
Entry
Created: 07/31/2019 08:25 AMUpdated: 06/27/2024 12:16 PM
Changes: 07/31/2019 08:25 AM (61), 07/15/2020 07:05 PM (1), 11/14/2023 09:15 AM (14), 06/27/2024 12:16 PM (16)
Complete: 🔍
Cache ID: 3:C4B:40
No comments yet. Languages: en.
Please log in to comment.