CVE-2019-11815

moderate-risk

Published 2019-05-08

An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.

Do I need to act?

1.2% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / HIGH complexity

Affected Products (20)

Linux Kernel

Ubuntu Linux

Debian Linux

Leap

Active Iq Unified Manager

Hci Management Node

Snapprotect

Solidfire

Storage Replication Adapter

Vasa Provider For Clustered Data Ontap

Affected Vendors

Debian Linux Canonical Netapp Opensuse

References (38)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html

Third Party Advisory http://packetstormsecurity.com/files/153799/Kernel-Live-Patch-Security-Notice-LS...

Third Party Advisory http://www.securityfocus.com/bid/108283

Release Notes https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8

Exploit https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb66d...

Exploit https://github.com/torvalds/linux/commit/cb66ddd156203daefb8d71158036b27b0e2caf6...

Mailing List https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html

Issue Tracking https://seclists.org/bugtraq/2019/Jun/26

Third Party Advisory https://security.netapp.com/advisory/ntap-20190719-0003/

Third Party Advisory https://support.f5.com/csp/article/K32019083

Third Party Advisory https://usn.ubuntu.com/4005-1/

Third Party Advisory https://usn.ubuntu.com/4008-1/

Third Party Advisory https://usn.ubuntu.com/4008-3/

Third Party Advisory https://usn.ubuntu.com/4068-1/

Third Party Advisory https://usn.ubuntu.com/4068-2/

Third Party Advisory https://usn.ubuntu.com/4118-1/

Third Party Advisory https://www.debian.org/security/2019/dsa-4465

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.html

and 18 more references

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 4/34 · Minimal

Exposure 21/34 · High