Linux Kernel up to 5.3.11 bfad_attr.c bfad_im_get_stats resource consumption

Summaryinfo

A vulnerability has been found in Linux Kernel up to 5.3.11 and classified as problematic. Affected by this issue is the function bfad_im_get_stats of the file drivers/scsi/bfa/bfad_attr.c. The manipulation leads to resource consumption. This vulnerability is listed as CVE-2019-19066. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 5.3.11 (Operating System). This issue affects the function bfad_im_get_stats of the file drivers/scsi/bfa/bfad_attr.c. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.

The weakness was presented 11/18/2019. The identification of this vulnerability is CVE-2019-19066 since 11/18/2019. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/23/2024). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-145887, VDB-145886, VDB-145885 and VDB-145884 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion