CVE-2019-14821

Published: 19/09/2019 Updated: 16/02/2024

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 8.8 | Impact Score: 6 | Exploitability Score: 2

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

An out-of-bounds access issue was found in the Linux kernel, all versions up to and including 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
linux linux kernel 5.4
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux for real time 7
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
redhat virtualization host 4.0
redhat enterprise linux 8.0
redhat enterprise linux server aus 7.7
redhat enterprise linux server tus 7.7
redhat enterprise linux eus 7.7
redhat enterprise linux for real time 8
canonical ubuntu linux 18.04
canonical ubuntu linux 19.04
canonical ubuntu linux 14.04
canonical ubuntu linux 16.04
opensuse leap 15.0
opensuse leap 15.1
fedoraproject fedora 29
fedoraproject fedora 30
debian debian linux 8.0
debian debian linux 9.0
debian debian linux 10.0
netapp aff a700s firmware -
netapp h300s firmware -
netapp h500s firmware -
netapp h700s firmware -
netapp h300e firmware -
netapp h500e firmware -
netapp h700e firmware -
netapp h410s firmware -
netapp h410c firmware -
netapp h610s firmware -
netapp data availability services -
netapp solidfire -
netapp hci management node -
oracle sd-wan edge 8.2
oracle sd-wan edge 7.3
oracle sd-wan edge 8.0
oracle sd-wan edge 8.1

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2019-14821 Matt Delco reported a race condition in KVM's coalesced MMIO facility, which could lead to out-of-bounds access in the kernel A local attacker permitted to access /dev/kvm cou ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 76 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabili ...

Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...

Synopsis Important: kernel-alt security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for kernel-alt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability S ...

Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring S ...

Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Important A Common V ...

An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process An unprivileged host user or process w ...

Several security issues were fixed in the Linux kernel ...

Impact: Important Public Date: 2019-09-17 CWE: CWE-787 Bugzilla: 1746708: CVE-2019-14821 Kernel: KVM: O ...

Hello, Upstream patch: --------------- -> gitkernelorg/pub/scm/virt/kvm/kvmgit/commit/?id=b60fe990c6b07ef6d4df67bc0530c7c90a62623a This issue was reported by Matt Delco of Google Inc Thank you -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F ...

CWE-787 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14821 http://www.openwall.com/lists/oss-security/2019/09/20/1 https://www.debian.org/security/2019/dsa-4531 https://seclists.org/bugtraq/2019/Sep/41 https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html https://security.netapp.com/advisory/ntap-20191004-0001/http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html https://usn.ubuntu.com/4157-1/https://usn.ubuntu.com/4157-2/https://usn.ubuntu.com/4162-1/https://usn.ubuntu.com/4163-1/https://usn.ubuntu.com/4163-2/https://usn.ubuntu.com/4162-2/http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html https://access.redhat.com/errata/RHSA-2019:3517 https://access.redhat.com/errata/RHSA-2019:3309 https://seclists.org/bugtraq/2019/Nov/11 http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html https://access.redhat.com/errata/RHSA-2019:3978 https://access.redhat.com/errata/RHSA-2019:3979 https://access.redhat.com/errata/RHSA-2019:4154 https://access.redhat.com/errata/RHSA-2019:4256 https://access.redhat.com/errata/RHSA-2020:0027 https://access.redhat.com/errata/RHSA-2020:0204 https://www.oracle.com/security-alerts/cpuapr2020.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZQQQANZWQMPILZV7OTS3RGGRLLE2Q7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/https://nvd.nist.gov https://www.debian.org/security/2019/dsa-4531 https://usn.ubuntu.com/4163-1/

Get Started

CVE-2019-14821

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect