Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-6974

CWE-362 — Race ConditionCWE-416 — Use After Free21 documents10 sources
Severity
8.1HIGH
EPSS
7.9%
top 7.96%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
24
F5 Big-ip Access Policy ManagerF5 Big-ip Advanced Firewall ManagerF5 Big-ip Analytics+21 more
Timeline
PublishedFeb 15
Latest updateMay 13

Description

In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages17 packages

▶NVDlinux/linux_kernel3.10 — 3.16.64+6
▶Debianlinux< 4.19.20-1+3

Also affects: Debian Linux 8.0, Ubuntu Linux 12.04, 14.04, 16.04, 18.04, 18.10, Enterprise Linux 7.0, 7.5, 7.4, 7.6, Openshift Container Platform 3.11

Patches

Patch: git.kernel.org ↗Patch: bugs.chromium.org ↗Patch: github.com ↗

🔴Vulnerability Details

6
GHSA
GHSA-gvrg-rwmc-m69h: In the Linux kernel before 4↗2022-05-13
▶
OSV
CVE-2019-6974: In the Linux kernel before 4↗2019-02-15
▶
Kernel
Merge tag 'v5.0-rc6' into for-5.1/block↗2019-02-15
▶
CVEList
CVE-2019-6974: In the Linux kernel before 4↗2019-02-15
▶
Kernel
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm↗2019-02-07
▶

💥Exploits & PoCs

1
Exploit-DB
Linux - 'kvm_ioctl_create_device()' NULL Pointer Dereference↗2019-02-15
▶

📋Vendor Advisories

10
Ubuntu
Linux kernel (HWE) vulnerabilities↗2019-04-02
▶
Ubuntu
Linux kernel (HWE) vulnerabilities↗2019-04-02
▶
Ubuntu
Linux kernel vulnerabilities↗2019-04-02
▶
Ubuntu
Linux kernel vulnerabilities↗2019-04-02
▶
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities↗2019-04-02
▶

💬Community

3
Bugzilla
CVE-2019-6974 kernel: KVM: potential use-after-free via kvm_ioctl_create_device() [fedora-all]↗2019-02-07
▶
Bugzilla
CVE-2019-6974 kernel: KVM: potential use-after-free via kvm_ioctl_create_device() [fedora-all]↗2019-02-07
▶
Bugzilla
CVE-2019-6974 Kernel: KVM: potential use-after-free via kvm_ioctl_create_device()↗2019-02-02
▶
CVE-2019-6974 (HIGH CVSS 8.1) | In the Linux kernel before 4.20.8 | cvebase.io