Linux Kernel up to 5.3.5 cls.c nfp_abm_u32_knode_replace resource consumption ⚔ [Disputed]

Summaryinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 5.3.5. Affected by this vulnerability is the function nfp_abm_u32_knode_replace of the file drivers/net/ethernet/netronome/nfp/abm/cls.c. Performing a manipulation results in resource consumption. This vulnerability was named CVE-2019-19076. The attack may be initiated remotely. There is no available exploit. The real existence of this vulnerability is still doubted at the moment. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 5.3.5 (Operating System). This affects the function nfp_abm_u32_knode_replace of the file drivers/net/ethernet/netronome/nfp/abm/cls.c. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to cause a denial of service (memory consumption), aka CID-78beef629fd9.

The weakness was presented 11/18/2019. This vulnerability is uniquely identified as CVE-2019-19076 since 11/18/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The real existence of this vulnerability is still doubted at the moment.

Upgrading to version 5.3.6 eliminates this vulnerability.

See VDB-145897, VDB-145896, VDB-145895 and VDB-145894 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion