NetSight
IP …
high8.1Public exploit code

CVE-2019-6974

In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-a…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.10 before 3.16.64
from 3.17 before 3.18.136
from 3.19 before 4.4.176
from 4.5 before 4.9.156
from 4.10 before 4.14.99
from 4.15 before 4.19.21
DebianDebian Linux
Version 8.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 18.10
F5Big-Ip Access Policy Manager
from 13.0.0 through 13.1.1
from 14.0.0 through 14.1.0
from 15.0.0 before 15.1.0
F5Big-Ip Advanced Firewall Manager
from 13.0.0 through 13.1.1
from 14.0.0 through 14.1.0
from 15.0.0 before 15.1.0
F5Big-Ip Analytics
from 13.0.0 through 13.1.1
from 14.0.0 through 14.1.0
from 15.0.0 before 15.1.0
F5Big-Ip Application Acceleration Manager
from 13.0.0 through 13.1.1
from 14.0.0 through 14.1.0
from 15.0.0 before 15.1.0
F5Big-Ip Application Security Manager
from 13.0.0 through 13.1.1
from 14.0.0 through 14.1.0
from 15.0.0 before 15.1.0
F5Big-Ip Edge Gateway
from 13.0.0 through 13.1.1
from 14.0.0 through 14.1.0
from 15.0.0 before 15.1.0
F5Big-Ip Fraud Protection Service
from 13.0.0 through 13.1.1
from 14.0.0 through 14.1.0
from 15.0.0 before 15.1.0
F5Big-Ip Global Traffic Manager
from 13.0.0 through 13.1.1
from 14.0.0 through 14.1.0
from 15.0.0 before 15.1.0
F5Big-Ip Link Controller
from 13.0.0 through 13.1.1
from 14.0.0 through 14.1.0
from 15.0.0 before 15.1.0

Weakness classification

CWE-362CWE-416

References