Published: 19/09/2019 Updated: 16/02/2024

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 8.8 | Impact Score: 6 | Exploitability Score: 2

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

An out-of-bounds access issue was found in the Linux kernel, all versions up to and including 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
linux linux kernel 5.4
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux for real time 7
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
redhat virtualization host 4.0
redhat enterprise linux 8.0
redhat enterprise linux server aus 7.7
redhat enterprise linux server tus 7.7
redhat enterprise linux eus 7.7
redhat enterprise linux for real time 8
canonical ubuntu linux 18.04
canonical ubuntu linux 19.04
canonical ubuntu linux 14.04
canonical ubuntu linux 16.04
opensuse leap 15.0
opensuse leap 15.1
fedoraproject fedora 29
fedoraproject fedora 30
debian debian linux 8.0
debian debian linux 9.0
debian debian linux 10.0
netapp aff_a700s_firmware -
netapp h300s_firmware -
netapp h500s_firmware -
netapp h700s_firmware -
netapp h300e_firmware -
netapp h500e_firmware -
netapp h700e_firmware -
netapp h410s_firmware -
netapp h410c_firmware -
netapp h610s_firmware -
netapp data availability services -
netapp solidfire -
netapp hci management node -
oracle sd-wan edge 8.2
oracle sd-wan edge 7.3
oracle sd-wan edge 8.0
oracle sd-wan edge 8.1

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2019-14821 Matt Delco reported a race condition in KVM's coalesced MMIO facility, which could lead to out-of-bounds access in the kernel A local attacker permitted to access /dev/kvm cou ...

Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 76 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabili ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...

Synopsis Important: kernel-alt security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for kernel-alt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability S ...

Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring S ...

Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Important A Common V ...

An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process An unprivileged host user or process w ...

Several security issues were fixed in the Linux kernel ...

Impact: Important Public Date: 2019-09-17 CWE: CWE-787 Bugzilla: 1746708: CVE-2019-14821 Kernel: KVM: O ...

CWE-787 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14821 http://www.openwall.com/lists/oss-security/2019/09/20/1 https://www.debian.org/security/2019/dsa-4531 https://seclists.org/bugtraq/2019/Sep/41 https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html https://security.netapp.com/advisory/ntap-20191004-0001/http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html https://usn.ubuntu.com/4157-1/https://usn.ubuntu.com/4157-2/https://usn.ubuntu.com/4162-1/https://usn.ubuntu.com/4163-1/https://usn.ubuntu.com/4163-2/https://usn.ubuntu.com/4162-2/http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html https://access.redhat.com/errata/RHSA-2019:3517 https://access.redhat.com/errata/RHSA-2019:3309 https://seclists.org/bugtraq/2019/Nov/11 http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html https://access.redhat.com/errata/RHSA-2019:3978 https://access.redhat.com/errata/RHSA-2019:3979 https://access.redhat.com/errata/RHSA-2019:4154 https://access.redhat.com/errata/RHSA-2019:4256 https://access.redhat.com/errata/RHSA-2020:0027 https://access.redhat.com/errata/RHSA-2020:0204 https://www.oracle.com/security-alerts/cpuapr2020.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZQQQANZWQMPILZV7OTS3RGGRLLE2Q7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/https://www.debian.org/security/2019/dsa-4531 https://nvd.nist.gov https://usn.ubuntu.com/4163-1/

Get Started

CVE-2019-14821

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect