CVE-2019-3900 Information

Description

An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6 while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user maybe remote one could use this flaw to stall the vhost_net kernel thread resulting in a DoS scenario.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Reference

http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html http://www.securityfocus.com/bid/108076 https://access.redhat.com/errata/RHSA-2019:1973 https://access.redhat.com/errata/RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2043 https://access.redhat.com/errata/RHSA-2019:3220 https://access.redhat.com/errata/RHSA-2019:3309 https://access.redhat.com/errata/RHSA-2019:3517 https://access.redhat.com/errata/RHSA-2019:3836 https://access.redhat.com/errata/RHSA-2019:3967 https://access.redhat.com/errata/RHSA-2019:4058 https://access.redhat.com/errata/RHSA-2020:0204 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3900 https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYTZH6QCNITK7353S6RCRT2PQHZSDPXD/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RI3WXXM5URTZSR3RVEKO6MDXDFIKTZ5R/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TOFNJA5NNVXQ6AV6KGZB677JIVXAMJHT/ https://seclists.org/bugtraq/2019/Aug/18 https://seclists.org/bugtraq/2019/Nov/11 https://security.netapp.com/advisory/ntap-20190517-0005/ https://usn.ubuntu.com/4114-1/ https://usn.ubuntu.com/4115-1/ https://usn.ubuntu.com/4116-1/ https://usn.ubuntu.com/4117-1/ https://usn.ubuntu.com/4118-1/ https://www.debian.org/security/2019/dsa-4497 https://www.spinics.net/lists/kernel/msg3111012.html

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

CHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

7.7