CVE-2019-18806
published 2019-11-07CVE-2019-18806: A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows local users to cause a…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.35%
27.5th percentile
A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows local users to cause a denial of service (memory consumption) by triggering pci_dma_mapping_error() failures, aka CID-1acb8f2a7a9f.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.3.7-1 (bookworm) | linux 5.3.7-1 (bookworm) |
| linux | linux_kernel | < 5.3.5 | 5.3.5 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9m44-5m43-4rmj: A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx
ghsa_unreviewed·2022-05-24
CVE-2019-18806 [LOW] GHSA-9m44-5m43-4rmj: A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx
A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows local users to cause a denial of service (memory consumption) by triggering pci_dma_mapping_error() failures, aka CID-1acb8f2a7a9f.
OSV
CVE-2019-18806: A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx
osv·2019-11-07·CVSS 5.5
CVE-2019-18806 [MEDIUM] CVE-2019-18806: A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx
A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows local users to cause a denial of service (memory consumption) by triggering pci_dma_mapping_error() failures, aka CID-1acb8f2a7a9f.
Red Hat
kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c
vendor_redhat·2019-10-07·CVSS 5.5
CVE-2019-18806 [MEDIUM] CWE-400 kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c
kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c
A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows local users to cause a denial of service (memory consumption) by triggering pci_dma_mapping_error() failures, aka CID-1acb8f2a7a9f.
A flaw was found in the way the QLogic QLA3xxx NIC HBA Driver in the Linux kernel handled resource cleanup on a DMA mapping error. This flaw allows an attacker able to trigger the DMA mapping error to crash the system.
Statement: This issue is rated as having Low impact because of the preconditions needed to trigger the resource cleanup code path (DMA mapping error).
Mitigation: In order to mitigate this issue it is possible t
Debian
CVE-2019-18806: linux - A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/q...
vendor_debian·2019·CVSS 5.5
CVE-2019-18806 [MEDIUM] CVE-2019-18806: linux - A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/q...
A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows local users to cause a denial of service (memory consumption) by triggering pci_dma_mapping_error() failures, aka CID-1acb8f2a7a9f.
Scope: local
bookworm: resolved (fixed in 5.3.7-1)
bullseye: resolved (fixed in 5.3.7-1)
forky: resolved (fixed in 5.3.7-1)
sid: resolved (fixed in 5.3.7-1)
trixie: resolved (fixed in 5.3.7-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-18806 kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c [fedora-all]
bugzilla·2020-04-22·CVSS 5.5
CVE-2019-18806 [MEDIUM] CVE-2019-18806 kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c [fedora-all]
CVE-2019-18806 kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE
Bugzilla
CVE-2019-18806 kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c
bugzilla·2019-11-27·CVSS 5.5
CVE-2019-18806 [MEDIUM] CVE-2019-18806 kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c
CVE-2019-18806 kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c
A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel allows local users to cause a denial of service (memory consumption) by triggering pci_dma_mapping_error() failures.
Reference:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.5
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1acb8f2a7a9f10543868ddd737e37424d5c36cf4
Discussion:
This was fixed for Fedora with the 5.3.5 stable kernel updates.
---
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1826573]
---
Mitigation:
In order to mitigate this issue it is possible to prevent the affected code from
Bugzilla
CVE-2019-18806 kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c [fedora-all]
bugzilla·2019-11-27·CVSS 5.5
CVE-2019-18806 [MEDIUM] CVE-2019-18806 kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c [fedora-all]
CVE-2019-18806 kernel: memory leak in ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.5https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1acb8f2a7a9f10543868ddd737e37424d5c36cf4https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.5https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1acb8f2a7a9f10543868ddd737e37424d5c36cf4
2019-11-07
Published