NetSight
IP …
critical9.8

CVE-2019-18805

An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11.

Impact

An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.4 before 4.4.180
from 4.9 before 4.9.172
from 4.14 before 4.14.115
from 4.19 before 4.19.38
from 5.0 before 5.0.11
Version 5.1
OpensuseLeap
Versions 15.0, 15.1
RedhatEnterprise Linux
Version 7.0
NetappActive Iq Unified Manager
All versions
NetappData Availability Services
All versions
NetappE-Series Santricity Os Controller
from 11.0.0 through 11.60.3
NetappHci Management Node
All versions
NetappSolidfire
All versions
NetappSteelstore Cloud Integrated Storage
All versions
NetappHci Compute Node
All versions
NetappHci Storage Node
All versions
BroadcomFabric Operating System
All versions

Weakness classification

CWE-190

References