CVE-2019-19080
published 2019-11-18CVE-2019-19080: Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow…
PriorityP426medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
2.81%
85.1th percentile
Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.3.7-1 (bookworm) | linux 5.3.7-1 (bookworm) |
| linux | linux_kernel | < 5.3.4 | 5.3.4 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9hfg-7492-qqv8: Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main
ghsa_unreviewed·2022-05-24
CVE-2019-19080 [HIGH] GHSA-9hfg-7492-qqv8: Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main
Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
OSV
CVE-2019-19080: Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main
osv·2019-11-18·CVSS 5.9
CVE-2019-19080 [MEDIUM] CVE-2019-19080: Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main
Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
Red Hat
kernel: memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
vendor_redhat·2019-09-25·CVSS 5.9
CVE-2019-19080 [MEDIUM] CWE-400 kernel: memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
kernel: memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
A flaw was found in the way the NFP4000/NFP6000 TC Flower offload functionality in the Linux kernel handled memory cleanup on failures. This flaw allows an attacker to cause a denial of service and crash the system.
Statement: This issue is rated as having Low impact because of the low memory conditions needed to trigger this issue.
Mitigation: To mitigate this issue, prevent module nfp from being loaded. Please see https://
Debian
CVE-2019-19080: linux - Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/et...
vendor_debian·2019·CVSS 5.9
CVE-2019-19080 [MEDIUM] CVE-2019-19080: linux - Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/et...
Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
Scope: local
bookworm: resolved (fixed in 5.3.7-1)
bullseye: resolved (fixed in 5.3.7-1)
forky: resolved (fixed in 5.3.7-1)
sid: resolved (fixed in 5.3.7-1)
trixie: resolved (fixed in 5.3.7-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-19080 kernel: memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS [fedora-all]
bugzilla·2019-11-25·CVSS 5.9
CVE-2019-19080 [MEDIUM] CVE-2019-19080 kernel: memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS [fedora-all]
CVE-2019-19080 kernel: memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and
Bugzilla
CVE-2019-19080 kernel: memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
bugzilla·2019-11-25·CVSS 5.9
CVE-2019-19080 [MEDIUM] CVE-2019-19080 kernel: memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
CVE-2019-19080 kernel: memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
Reference and upstream commit:
https://github.com/torvalds/linux/commit/8572cea1461a006bce1d06c0c4b0575869125fa4
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1776373]
---
This was fixed for Fedora with the 5.3.4 stable kernel updates.
---
Statement:
This issue is rated as having Low impact because of the low memory conditions needed to trigger this issue.
---
Mitiga
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.htmlhttps://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4https://github.com/torvalds/linux/commit/8572cea1461a006bce1d06c0c4b0575869125fa4https://security.netapp.com/advisory/ntap-20191205-0001/http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.htmlhttps://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4https://github.com/torvalds/linux/commit/8572cea1461a006bce1d06c0c4b0575869125fa4https://security.netapp.com/advisory/ntap-20191205-0001/
2019-11-18
Published