NetSight
IP …
high7.8

CVE-2019-14835

A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, lo…

Impact

A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.34 before 3.16.74
from 4.4 before 4.4.193
from 4.9 before 4.9.193
from 4.14 before 4.14.144
from 4.19 before 4.19.73
from 5.2 before 5.2.15
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 19.04
DebianDebian Linux
Versions 8.0, 9.0, 10.0
FedoraprojectFedora
Versions 29, 30
OpensuseLeap
Versions 15.0, 15.1
NetappAff A700s Firmware
All versions
NetappH410c Firmware
All versions
NetappH610s Firmware
All versions
NetappH300s Firmware
All versions
NetappH500s Firmware
All versions
NetappH700s Firmware
All versions
NetappH300e Firmware
All versions

Weakness classification

CWE-120

References