CVE-2019-17075
published 2019-10-01CVE-2019-17075: An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
6.24%
92.8th percentile
An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.3.7-1 (bookworm) | linux 5.3.7-1 (bookworm) |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 4.4.0-170.199 | 4.4.0-170.199 |
| linux | linux_kernel | >= 0 < 4.15.0-72.81 | 4.15.0-72.81 |
| linux | linux_kernel | >= 2.6.35 < 4.4.198 | 4.4.198 |
| linux | linux_kernel | >= 4.10 < 4.14.151 | 4.14.151 |
| linux | linux_kernel | >= 4.15 < 4.19.81 | 4.19.81 |
| linux | linux_kernel | >= 4.20 < 5.3.8 | 5.3.8 |
| linux | linux_kernel | >= 4.5.0 < 4.9.198 | 4.9.198 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-01-07·CVSS 8.8
CVE-2019-10220 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Michael Hanselmann discovered that the CIFS implementation in the Linux
kernel did not sanitize paths returned by an SMB server. An attacker
controlling an SMB server could use this to overwrite arbitrary files.
(CVE-2019-10220)
It was discovered that a heap-based buffer overflow existed in the Marvell
WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-14895, CVE-2019-14901)
It was discovered that a heap-based buffer overflow existed in the Marvell
Libertas WLAN Driver for the Linux kernel. A physically proximate attacker
could use this to cause a denial of service
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2019-12-03·CVSS 9.8
CVE-2018-20784 [CRITICAL] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-4211-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 ESM.
Zhipeng Xie discovered that an infinite loop could be triggered in the CFS
Linux kernel process scheduler. A local attacker could possibly use this to
cause a denial of service. (CVE-2018-20784)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
Nicolas Waisman discovered that the Chelsio T4/T5
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-12-03·CVSS 9.8
CVE-2019-16746 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a buffer overflow existed in the 802.11 Wi-Fi
configuration interface for the Linux kernel when handling beacon settings.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2019-16746)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
attacker could use this to cause a denial of service
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-12-03·CVSS 9.8
CVE-2018-20784 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zhipeng Xie discovered that an infinite loop could be triggered in the CFS
Linux kernel process scheduler. A local attacker could possibly use this to
cause a denial of service. (CVE-2018-20784)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
Nicolas Waisman discovered that the Chelsio T4/T5 RDMA Driver for the Linux
kernel performed DMA from a kernel stack. A local attacker could use this
to cause a denial of service (system crash). (CVE-2019-17075)
Instructions: After a standard system update you need to reboot
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-12-02·CVSS 7.1
CVE-2019-15794 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Jann Horn discovered that the OverlayFS and ShiftFS Drivers in the Linux
kernel did not properly handle reference counting during memory mapping
operations when used in conjunction with AUFS. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-15794)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
It was discovered that the ARM Komeda display driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
attac
Red Hat
kernel: denial of service in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c
vendor_redhat·2019-10-01·CVSS 7.5
CVE-2019-17075 [HIGH] CWE-400 kernel: denial of service in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c
kernel: denial of service in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c
An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.
A denial of service (DoS) was found in the write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the cxgb4' Chelsio T4/T5 RDMA Driver. Some of the architectures performing the DMA operation directly from the stack variable (instead of the heap) allows an attacker in the network to cause some security threat.
Mitigation: Mitigati
Debian
CVE-2019-17075: linux - An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c ...
vendor_debian·2019·CVSS 7.5
CVE-2019-17075 [HIGH] CVE-2019-17075: linux - An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c ...
An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.
Scope: local
bookworm: resolved (fixed in 5.3.7-1)
bullseye: resolved (fixed in 5.3.7-1)
forky: resolved (fixed in 5.3.7-1)
sid: resolved (fixed in 5.3.7-1)
trixie: resolved (fixed in 5.3.7-1)
GHSA
GHSA-gr9g-q7vr-6rvv: An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem
ghsa_unreviewed·2022-05-24
CVE-2019-17075 [HIGH] GHSA-gr9g-q7vr-6rvv: An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem
An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.
OSV
linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2 vulnerabilities
osv·2020-01-07·CVSS 8.8
CVE-2019-10220 [HIGH] linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2 vulnerabilities
linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2 vulnerabilities
Michael Hanselmann discovered that the CIFS implementation in the Linux
kernel did not sanitize paths returned by an SMB server. An attacker
controlling an SMB server could use this to overwrite arbitrary files.
(CVE-2019-10220)
It was discovered that a heap-based buffer overflow existed in the Marvell
WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-14895, CVE-2019-14901)
It was discovered that a heap-based buffer overflow existed in the Marvell
Libertas WLAN Driver for the Linux kernel. A physically proxi
OSV
linux-lts-xenial, linux-aws vulnerabilities
osv·2019-12-03·CVSS 9.8
CVE-2018-20784 [CRITICAL] linux-lts-xenial, linux-aws vulnerabilities
linux-lts-xenial, linux-aws vulnerabilities
USN-4211-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 ESM.
Zhipeng Xie discovered that an infinite loop could be triggered in the CFS
Linux kernel process scheduler. A local attacker could possibly use this to
cause a denial of service. (CVE-2018-20784)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
Nicolas Waisman discovered that the Chelsio T4/T5 RDMA Driver for the Linux
kernel performed DMA from a kernel stack. A l
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-12-03·CVSS 9.8
CVE-2018-20784 [CRITICAL] linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
Zhipeng Xie discovered that an infinite loop could be triggered in the CFS
Linux kernel process scheduler. A local attacker could possibly use this to
cause a denial of service. (CVE-2018-20784)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
Nicolas Waisman discovered that the Chelsio T4/T5 RDMA Driver for the Linux
kernel performed DMA from a kernel stack. A local attacker could use this
to cause a denial of service (system crash). (CVE-2019-17075)
OSV
linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-12-03·CVSS 9.8
CVE-2019-16746 [CRITICAL] linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that a buffer overflow existed in the 802.11 Wi-Fi
configuration interface for the Linux kernel when handling beacon settings.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2019-16746)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
a
OSV
linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-kvm, linux-oracle vulnerabilities
osv·2019-12-02·CVSS 6.7
CVE-2019-15794 [MEDIUM] linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-kvm, linux-oracle vulnerabilities
linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-kvm, linux-oracle vulnerabilities
Jann Horn discovered that the OverlayFS and ShiftFS Drivers in the Linux
kernel did not properly handle reference counting during memory mapping
operations when used in conjunction with AUFS. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-15794)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
It was discovered that the ARM Komeda display driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
attacker could use this
OSV
CVE-2019-17075: An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem
osv·2019-10-01·CVSS 7.5
CVE-2019-17075 [HIGH] CVE-2019-17075: An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem
An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-17075 kernel: denial of service in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c [fedora-all]
bugzilla·2019-10-09·CVSS 7.5
CVE-2019-17075 [HIGH] CVE-2019-17075 kernel: denial of service in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c [fedora-all]
CVE-2019-17075 kernel: denial of service in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue aff
Bugzilla
CVE-2019-17075 kernel: denial of service in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c
bugzilla·2019-10-09·CVSS 7.5
CVE-2019-17075 [HIGH] CVE-2019-17075 kernel: denial of service in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c
CVE-2019-17075 kernel: denial of service in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c
An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.
Reference:
https://lore.kernel.org/lkml/[email protected]
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1759768]
---
This was fixed for Fedora with the 5.3.8 stable kernel updates.
---
Mitigation:
Mitigation for this issue is either not available or the currently availab
http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlhttps://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlhttps://lore.kernel.org/lkml/20191001165611.GA3542072%40kroah.comhttps://seclists.org/bugtraq/2019/Nov/11https://usn.ubuntu.com/4208-1/https://usn.ubuntu.com/4210-1/https://usn.ubuntu.com/4211-1/https://usn.ubuntu.com/4211-2/https://usn.ubuntu.com/4226-1/https://www.oracle.com/security-alerts/cpuApr2021.htmlhttp://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlhttps://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlhttps://lore.kernel.org/lkml/20191001165611.GA3542072%40kroah.comhttps://seclists.org/bugtraq/2019/Nov/11https://usn.ubuntu.com/4208-1/https://usn.ubuntu.com/4210-1/https://usn.ubuntu.com/4211-1/https://usn.ubuntu.com/4211-2/https://usn.ubuntu.com/4226-1/https://www.oracle.com/security-alerts/cpuApr2021.html
2019-10-01
Published