CVE-2019-19081
published 2019-11-18CVE-2019-19081: A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows…
PriorityP424medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
3.26%
87.0th percentile
A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.3.7-1 (bookworm) | linux 5.3.7-1 (bookworm) |
| linux | linux_kernel | < 5.3.4 | 5.3.4 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| opensuse | leap | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
vendor_redhat·2019-09-25·CVSS 5.9
CVE-2019-19081 [MEDIUM] CWE-400 kernel: memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
kernel: memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.
A flaw was found in the way the NFP4000/NFP6000 TC Flower offload functionality in the Linux kernel handled memory cleanup on failures. This flaw allows an attacker to cause a denial of service and crash the system.
Statement: This issue is rated as having Low impact because of the low memory conditions needed to trigger this issue.
Mitigation: To mitigate this issue, prevent module nfp from being loaded. Please see https://ac
Debian
CVE-2019-19081: linux - A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ether...
vendor_debian·2019·CVSS 5.9
CVE-2019-19081 [MEDIUM] CVE-2019-19081: linux - A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ether...
A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.
Scope: local
bookworm: resolved (fixed in 5.3.7-1)
bullseye: resolved (fixed in 5.3.7-1)
forky: resolved (fixed in 5.3.7-1)
sid: resolved (fixed in 5.3.7-1)
trixie: resolved (fixed in 5.3.7-1)
GHSA
GHSA-22mj-xmh9-hw2p: A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main
ghsa_unreviewed·2022-05-24
CVE-2019-19081 [HIGH] GHSA-22mj-xmh9-hw2p: A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main
A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.
OSV
CVE-2019-19081: A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main
osv·2019-11-18·CVSS 5.9
CVE-2019-19081 [MEDIUM] CVE-2019-19081: A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main
A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-19081 kernel: memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
bugzilla·2019-11-25·CVSS 5.9
CVE-2019-19081 [MEDIUM] CVE-2019-19081 kernel: memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
CVE-2019-19081 kernel: memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS
A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.
Reference and upstream commit:
https://github.com/torvalds/linux/commit/8ce39eb5a67aee25d9f05b40b673c95b23502e3e
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1776376]
---
This was fixed for Fedora with the 5.3.4 stable kernel updates.
---
Statement:
This issue is rated as having Low impact because of the low memory conditions needed to trigger this issue.
---
Mitigati
Bugzilla
CVE-2019-19081 kernel: memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS [fedora-all]
bugzilla·2019-11-25·CVSS 5.9
CVE-2019-19081 [MEDIUM] CVE-2019-19081 kernel: memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS [fedora-all]
CVE-2019-19081 kernel: memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c leads to DoS [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.htmlhttps://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4https://github.com/torvalds/linux/commit/8ce39eb5a67aee25d9f05b40b673c95b23502e3ehttps://security.netapp.com/advisory/ntap-20191205-0001/http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.htmlhttps://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4https://github.com/torvalds/linux/commit/8ce39eb5a67aee25d9f05b40b673c95b23502e3ehttps://security.netapp.com/advisory/ntap-20191205-0001/
2019-11-18
Published