CVE-2019-14835
published 2019-09-17CVE-2019-14835: A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.63%
46.0th percentile
A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.
Affected
65 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 5.2.17-1 (bookworm) | linux 5.2.17-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| huawei | imanager_neteco | — | — |
| huawei | imanager_neteco | — | — |
| huawei | imanager_neteco_6000 | — | — |
| huawei | imanager_neteco_6000 | — | — |
| huawei | manageone | — | — |
| huawei | manageone | — | — |
| huawei | manageone | — | — |
| huawei | manageone | — | — |
| huawei | manageone | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.2.17-1 | 5.2.17-1 |
| linux | linux_kernel | >= 0 < 5.2.17-1 | 5.2.17-1 |
| linux | linux_kernel | >= 0 < 5.2.17-1 | 5.2.17-1 |
| linux | linux_kernel | >= 0 < 5.2.17-1 | 5.2.17-1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.07.2HIGHCVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h3vw-f6h8-86mg: A buffer overflow flaw was found, in versions from 2
ghsa_unreviewed·2022-05-24
CVE-2019-14835 [HIGH] CWE-120 GHSA-h3vw-f6h8-86mg: A buffer overflow flaw was found, in versions from 2
A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.
Kernel
fortify: Detect struct member overflows in memcpy() at compile-time
kernel_security·2021-04-20
CVE-2019-0145 fortify: Detect struct member overflows in memcpy() at compile-time
fortify: Detect struct member overflows in memcpy() at compile-time
memcpy() is dead; long live memcpy()
tl;dr: In order to eliminate a large class of common buffer overflow
flaws that continue to persist in the kernel, have memcpy() (under
CONFIG_FORTIFY_SOURCE) perform bounds checking of the destination struct
member when they have a known size. This would have caught all of the
memcpy()-related buffer write overflow flaws identified in at least the
last three years.
Background and analysis:
While stack-based buffer overflow flaws are largely mitigated by stack
canaries (and similar) features, heap-based buffer overflow flaws continue
to regularly appear in the kernel. Many classes of heap buffer overflows
are mitigated by FORTIFY_SOURCE when using the strcpy() family of
functions, b
OSV
linux, linux-aws, linux-azure, linux-lts-trusty, linux-lts-xenial vulnerabilities
osv·2019-09-18·CVSS 7.8
CVE-2019-14835 [HIGH] linux, linux-aws, linux-azure, linux-lts-trusty, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-azure, linux-lts-trusty, linux-lts-xenial vulnerabilities
Peter Pi discovered a buffer overflow in the virtio network backend
(vhost_net) implementation in the Linux kernel. An attacker in a guest may
be able to use this to cause a denial of service (host OS crash) or
possibly execute arbitrary code in the host OS. (CVE-2019-14835)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle Facility Unavailable exceptions in some situations. A local
attacker could use this to expose sensitive information. (CVE-2019-15030)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle exceptions on interrupts in some situations. A local
attacker could use this to expose sensitive information. (CVE-2019-15031)
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-gke-5.0, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-09-18·CVSS 7.8
CVE-2019-14835 [HIGH] linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-gke-5.0, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-gke-5.0, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Peter Pi discovered a buffer overflow in the virtio network backend
(vhost_net) implementation in the Linux kernel. An attacker in a guest may
be able to use this to cause a denial of service (host OS crash) or
possibly execute arbitrary code in the host OS. (CVE-2019-14835)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle Facility Unavailable exceptions in some situations. A local
attacker could use this to expose sensitive information. (CVE-2019-15030)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle exceptions on interrupts in
OSV
CVE-2019-14835: A buffer overflow flaw was found, in versions from 2
osv·2019-09-17·CVSS 7.8
CVE-2019-14835 [HIGH] CVE-2019-14835: A buffer overflow flaw was found, in versions from 2
A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-09-18·CVSS 7.8
CVE-2019-14835 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Peter Pi discovered a buffer overflow in the virtio network backend
(vhost_net) implementation in the Linux kernel. An attacker in a guest may
be able to use this to cause a denial of service (host OS crash) or
possibly execute arbitrary code in the host OS. (CVE-2019-14835)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle Facility Unavailable exceptions in some situations. A local
attacker could use this to expose sensitive information. (CVE-2019-15030)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle exceptions on interrupts in some situations. A local
attacker could use this to expose sensitive informatio
Red Hat
kernel: vhost-net: guest to host kernel escape during migration
vendor_redhat·2019-09-17·CVSS 7.8
CVE-2019-14835 [HIGH] CWE-120 kernel: vhost-net: guest to host kernel escape during migration
kernel: vhost-net: guest to host kernel escape during migration
A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.
A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host. In the worst case
Debian
CVE-2019-14835: linux - A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way L...
vendor_debian·2019·CVSS 7.8
CVE-2019-14835 [HIGH] CVE-2019-14835: linux - A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way L...
A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.
Scope: local
bookworm: resolved (fixed in 5.2.17-1)
bullseye: resolved (fixed in 5.2.17-1)
forky: resolved (fixed in 5.2.17-1)
sid: resolved (fixed in 5.2.17-1)
trixie: resolved (fixed in 5.2.17-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-14835 kernel: vhost-net: guest to host kernel escape during migration [fedora-all]
bugzilla·2019-09-17·CVSS 7.8
CVE-2019-14835 [HIGH] CVE-2019-14835 kernel: vhost-net: guest to host kernel escape during migration [fedora-all]
CVE-2019-14835 kernel: vhost-net: guest to host kernel escape during migration [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supp
Bugzilla
CVE-2019-14835 kernel: vhost-net: guest to host kernel escape during migration
bugzilla·2019-09-10·CVSS 7.8
CVE-2019-14835 [HIGH] CVE-2019-14835 kernel: vhost-net: guest to host kernel escape during migration
CVE-2019-14835 kernel: vhost-net: guest to host kernel escape during migration
A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.
Discussion:
Acknowledgments:
Name: Peter Pi (Tencent Blade Team)
---
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=060423bfdee3f8bc6e2c1bac97de24d5415e2bc4
---
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1752794]
---
External References:
https://access.redhat.com/security/vulnerabilities/kerne
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlhttp://packetstormsecurity.com/files/154572/Kernel-Live-Patch-Security-Notice-LSN-0056-1.htmlhttp://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.htmlhttp://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlhttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-qemu-enhttp://www.openwall.com/lists/oss-security/2019/09/24/1http://www.openwall.com/lists/oss-security/2019/10/03/1http://www.openwall.com/lists/oss-security/2019/10/09/3http://www.openwall.com/lists/oss-security/2019/10/09/7https://access.redhat.com/errata/RHBA-2019:2824https://access.redhat.com/errata/RHSA-2019:2827https://access.redhat.com/errata/RHSA-2019:2828https://access.redhat.com/errata/RHSA-2019:2829https://access.redhat.com/errata/RHSA-2019:2830https://access.redhat.com/errata/RHSA-2019:2854https://access.redhat.com/errata/RHSA-2019:2862https://access.redhat.com/errata/RHSA-2019:2863https://access.redhat.com/errata/RHSA-2019:2864https://access.redhat.com/errata/RHSA-2019:2865https://access.redhat.com/errata/RHSA-2019:2866https://access.redhat.com/errata/RHSA-2019:2867https://access.redhat.com/errata/RHSA-2019:2869https://access.redhat.com/errata/RHSA-2019:2889https://access.redhat.com/errata/RHSA-2019:2899https://access.redhat.com/errata/RHSA-2019:2900https://access.redhat.com/errata/RHSA-2019:2901https://access.redhat.com/errata/RHSA-2019:2924https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14835https://lists.debian.org/debian-lts-announce/2019/09/msg00025.htmlhttps://lists.debian.org/debian-lts-announce/2019/10/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQFY6JYFIQ2VFQ7QCSXPWTUL5ZDNCJL5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/https://seclists.org/bugtraq/2019/Nov/11https://seclists.org/bugtraq/2019/Sep/41https://security.netapp.com/advisory/ntap-20191031-0005/https://usn.ubuntu.com/4135-1/https://usn.ubuntu.com/4135-2/https://www.debian.org/security/2019/dsa-4531https://www.openwall.com/lists/oss-security/2019/09/17/1http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlhttp://packetstormsecurity.com/files/154572/Kernel-Live-Patch-Security-Notice-LSN-0056-1.htmlhttp://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.htmlhttp://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlhttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-qemu-enhttp://www.openwall.com/lists/oss-security/2019/09/24/1http://www.openwall.com/lists/oss-security/2019/10/03/1http://www.openwall.com/lists/oss-security/2019/10/09/3http://www.openwall.com/lists/oss-security/2019/10/09/7https://access.redhat.com/errata/RHBA-2019:2824https://access.redhat.com/errata/RHSA-2019:2827https://access.redhat.com/errata/RHSA-2019:2828https://access.redhat.com/errata/RHSA-2019:2829https://access.redhat.com/errata/RHSA-2019:2830https://access.redhat.com/errata/RHSA-2019:2854https://access.redhat.com/errata/RHSA-2019:2862https://access.redhat.com/errata/RHSA-2019:2863https://access.redhat.com/errata/RHSA-2019:2864https://access.redhat.com/errata/RHSA-2019:2865https://access.redhat.com/errata/RHSA-2019:2866https://access.redhat.com/errata/RHSA-2019:2867https://access.redhat.com/errata/RHSA-2019:2869https://access.redhat.com/errata/RHSA-2019:2889https://access.redhat.com/errata/RHSA-2019:2899https://access.redhat.com/errata/RHSA-2019:2900https://access.redhat.com/errata/RHSA-2019:2901https://access.redhat.com/errata/RHSA-2019:2924https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14835https://lists.debian.org/debian-lts-announce/2019/09/msg00025.htmlhttps://lists.debian.org/debian-lts-announce/2019/10/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQFY6JYFIQ2VFQ7QCSXPWTUL5ZDNCJL5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/https://seclists.org/bugtraq/2019/Nov/11https://seclists.org/bugtraq/2019/Sep/41https://security.netapp.com/advisory/ntap-20191031-0005/https://usn.ubuntu.com/4135-1/https://usn.ubuntu.com/4135-2/https://www.debian.org/security/2019/dsa-4531https://www.openwall.com/lists/oss-security/2019/09/17/1
2019-09-17
Published