CVE-2019-19922 - 漏洞详情

CVE-2019-19922 (CNNVD-201912-987)

MEDIUM

中文标题:

Linux kernel 资源管理错误漏洞

英文标题:

kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kube...

CVSS分数: 5.5

发布时间: 2019-12-22 19:07:16

漏洞类型: 资源管理错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Linux kernel是美国Linux基金会发布的开源操作系统Linux所使用的内核。 Linux kernel 5.3.9之前版本中的kernel/sched/fair.c文件存在安全漏洞。攻击者可利用该漏洞造成拒绝服务。

英文描述:

kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)

CWE类型:

CWE-400

受影响产品

厂商	产品	版本	版本范围	平台	CPE
linux	linux_kernel	*	-	-	`cpe:2.3:o:linux:linux_kernel::::::::`
oracle	sd-wan_edge	8.2	-	-	`cpe:2.3:a:oracle:sd-wan_edge:8.2:::::::*`
canonical	ubuntu_linux	18.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::`
canonical	ubuntu_linux	19.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
netapp	active_iq_unified_manager	-	-	-	`cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::`
netapp	cloud_backup	-	-	-	`cpe:2.3:a:netapp:cloud_backup:-:::::::*`
netapp	data_availability_services	-	-	-	`cpe:2.3:a:netapp:data_availability_services:-:::::::*`
netapp	e-series_santricity_os_controller	*	-	-	`cpe:2.3:a:netapp:e-series_santricity_os_controller::::::::`
netapp	fas\/aff_baseboard_management_controller	-	-	-	`cpe:2.3:a:netapp:fas\/aff_baseboard_management_controller:-:::::::*`
netapp	hci_baseboard_management_controller	h610s	-	-	`cpe:2.3:a:netapp:hci_baseboard_management_controller:h610s:::::::*`
netapp	solidfire_\&_hci_management_node	-	-	-	`cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:::::::*`
netapp	steelstore_cloud_integrated_storage	-	-	-	`cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*`
netapp	aff_baseboard_management_controller	a700	-	-	`cpe:2.3:h:netapp:aff_baseboard_management_controller:a700:::::::*`
netapp	solidfire_baseboard_management_controller	-	-	-	`cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

USN-4226-1 vendor-advisory
cve.org

访问

[debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update mailing-list
cve.org

访问