Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-11599

CWE-667CWE-362 — Race ConditionCWE-82121 documents10 sources
Severity
7.0HIGH
EPSS
0.5%
top 32.08%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Linux Kernel KernelLinux Linux Kernel
Timeline
PublishedApr 29
Latest updateMay 24

Description

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages3 packages

▶NVDlinux/linux_kernel2.16.12 — 3.16.66+5
▶CVEListV5linux_kernel/kernel< 5.0.10
▶Debianlinux< 4.19.37-1+3

Patches

Patch: git.kernel.org ↗Patch: github.com ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-q8vw-4h9f-5745: The coredump implementation in the Linux kernel before 5↗2022-05-24
▶
OSV
linux-hwe vulnerabilities↗2019-08-01
▶
CVEList
CVE-2019-11599: The coredump implementation in the Linux kernel before 5↗2019-04-29
▶
OSV
CVE-2019-11599: The coredump implementation in the Linux kernel before 5↗2019-04-29
▶

💥Exploits & PoCs

1
Exploit-DB
Linux - Missing Locking Between ELF coredump code and userfaultfd VMA Modification↗2019-04-30
▶

📋Vendor Advisories

10
Android
CVE-2019-11599: Memory Map Subsystem↗2020-02-01
▶
Red Hat
kernel: incomplete fix for race condition between mmget_not_zero()/get_task_mm() and core dumping in CVE-2019-11599↗2019-11-20
▶
Ubuntu
Linux kernel (AWS) vulnerabilities↗2019-09-02
▶
Ubuntu
Linux kernel vulnerabilities↗2019-09-02
▶
Ubuntu
Linux kernel vulnerabilities↗2019-08-13
▶

💬Community

5
Bugzilla
CVE-2019-14898 kernel: incomplete fix for race condition between mmget_not_zero()/get_task_mm() and core dumping in CVE-2019-11599↗2019-11-20
▶
Bugzilla
CVE-2019-11599 kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping↗2019-05-03
▶
Bugzilla
CVE-2019-11599 kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping [fedora-all]↗2019-05-03
▶
Bugzilla
CVE-2019-11599 kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping [fedora-all]↗2019-04-04
▶
Bugzilla
CVE-2019-3892 kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping↗2019-04-04
▶