6.9
CVSSv2

CVE-2019-11599

Published: 29/04/2019 Updated: 15/02/2024
CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4
CVSS v3 Base Score: 7 | Impact Score: 5.9 | Exploitability Score: 1
VMScore: 695
Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

The coredump implementation in the Linux kernel prior to 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

Vendor Advisories

Debian Bug report logs - #928989 linux-image-4190-4-amd64: CVE-2019-11815 Package: src:linux; Maintainer for src:linux is Debian Kernel Team <debian-kernel@listsdebianorg>; Reported by: Jeff Cliff <jeffreycliff@gmailcom> Date: Tue, 14 May 2019 18:39:01 UTC Severity: important Tags: security Found in versions l ...
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2019-3846 , CVE-2019-10126 huangwen reported multiple buffer overflows in the Marvell wifi (mwifiex) driver, which a local user could use to cause denial of service or the execution of ar ...
An infinite loop issue was found in the vhost_net kernel module while handling incoming packets in handle_rx() The infinite loop could occur if one end sends packets faster than the other end can process them A guest user, maybe a remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario(CVE-2019-3900) A f ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise MRG 2Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVS ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...
Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 75 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Comm ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 74 Advanced Update Support, Red Hat Enterprise Linux 74 Telco Extended Update Support, and Red Hat Enterprise Linux 74 Update Services ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...
Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring S ...
Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring S ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...
Synopsis Moderate: kernel security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for kernel is now available for Red Hat Enterprise Linux 76 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...
An infinite loop issue was found in the vhost_net kernel module while handling incoming packets in handle_rx() The infinite loop could occur if one end sends packets faster than the other end can process them A guest user, maybe a remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario (CVE-2019-3900) A ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Impact: Moderate Public Date: 2019-04-19 CWE: CWE-362->CWE-667 Bugzilla: 1705937: CVE-2019-11599 ker ...

Exploits

elf_core_dump() has a comment back from something like 2543-C3 that says: /* * We no longer stop all VM operations * * This is because those proceses that could possibly change map_count * or the mmap / vma pages are now blocked in do_exit on current * finishing this core dump * ...
Linux suffers from a missing locking between ELF coredump code and userfaultfd VMA modification ...

Mailing Lists

<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Linux kernel: multiple issues <!--X-Subject-Header-End--> <!--X-Head-of-Message--> From: Jann Horn &lt;jannhorn () googlemai ...
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Re: Linux kernel: multiple issues <!--X-Subject-Header-End--> <!--X-Head-of-Message--> From: Salvatore Bonaccorso &lt;carnil ...

Github Repositories

POCs can run in some Linux kernel versions

POC-available POCs can run in some Linux kernel versions CVE-2019-11599 POC运行内核版本:462 运行方式: gcc -o coredump_helper coredump_helperc sudo /set_helpersh gcc -o dumpme dumpmec /dumpme 运行结果: 运行poc 通过dmesg查看日志 CVE-2019-9213 POC运行内核版本:462 运行方式: gcc -o nullmap nullmapc /nullmap 运行结果: CVE-

References

CWE-667https://github.com/torvalds/linux/commit/04f5866e41fb70690e28397487d8bd8eea7d712ahttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=04f5866e41fb70690e28397487d8bd8eea7d712ahttps://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.10https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.37https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.114https://bugs.chromium.org/p/project-zero/issues/detail?id=1790http://www.openwall.com/lists/oss-security/2019/04/29/2http://www.openwall.com/lists/oss-security/2019/04/29/1http://packetstormsecurity.com/files/152663/Linux-Missing-Lockdown.htmlhttp://www.openwall.com/lists/oss-security/2019/04/30/1https://www.exploit-db.com/exploits/46781/http://www.securityfocus.com/bid/108113https://security.netapp.com/advisory/ntap-20190517-0002/https://lists.debian.org/debian-lts-announce/2019/05/msg00041.htmlhttps://lists.debian.org/debian-lts-announce/2019/05/msg00042.htmlhttps://www.debian.org/security/2019/dsa-4465https://lists.debian.org/debian-lts-announce/2019/06/msg00011.htmlhttps://seclists.org/bugtraq/2019/Jun/26https://support.f5.com/csp/article/K51674118http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.htmlhttps://seclists.org/bugtraq/2019/Jul/33https://usn.ubuntu.com/4069-1/http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlhttps://usn.ubuntu.com/4069-2/https://access.redhat.com/errata/RHSA-2019:2043https://access.redhat.com/errata/RHSA-2019:2029https://usn.ubuntu.com/4095-1/https://usn.ubuntu.com/4115-1/https://usn.ubuntu.com/4118-1/https://access.redhat.com/errata/RHSA-2019:3309https://access.redhat.com/errata/RHSA-2019:3517https://access.redhat.com/errata/RHSA-2020:0100https://access.redhat.com/errata/RHSA-2020:0103https://access.redhat.com/errata/RHSA-2020:0179https://access.redhat.com/errata/RHSA-2020:0543https://security.netapp.com/advisory/ntap-20200608-0001/https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://support.f5.com/csp/article/K51674118?utm_source=f5support&%3Butm_medium=RSShttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928989https://nvd.nist.govhttps://github.com/HaleyWei/POC-availablehttps://www.exploit-db.com/exploits/46781https://www.debian.org/security/2019/dsa-4465https://usn.ubuntu.com/4069-1/