CVE-2019-3874

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-3874
The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

3.3 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:A/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 6.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://access.redhat.com/errata/RHSA-2019:3309 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3517 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3874 Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20190411-0003/ Third Party Advisory
https://usn.ubuntu.com/3979-1/ Third Party Advisory
https://usn.ubuntu.com/3980-1/ Third Party Advisory
https://usn.ubuntu.com/3980-2/ Third Party Advisory
https://usn.ubuntu.com/3981-1/ Third Party Advisory
https://usn.ubuntu.com/3981-2/ Third Party Advisory
https://usn.ubuntu.com/3982-1/ Third Party Advisory
https://usn.ubuntu.com/3982-2/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:netapp:active_iq_unified_manager_for_vmware_vsphere:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:*
History

12 Feb 2023, 23:38

Type Values Removed Values Added
Summary The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable.
CWE NVD-CWE-noinfo CWE-400
References
  • {'url': 'https://discuss.kubernetes.io/t/kubernetes-security-announcement-linux-kernel-memory-cgroups-escape-via-sctp-cve-2019-3874/5594', 'name': 'https://discuss.kubernetes.io/t/kubernetes-security-announcement-linux-kernel-memory-cgroups-escape-via-sctp-cve-2019-3874/5594', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://lore.kernel.org/netdev/20190401113110.GA20717@hmswarspite.think-freely.org/T/#u', 'name': 'https://lore.kernel.org/netdev/20190401113110.GA20717@hmswarspite.think-freely.org/T/#u', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2019-3874', 'name': 'https://access.redhat.com/security/cve/CVE-2019-3874', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1686373', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1686373', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:18

Type Values Removed Values Added
Summary The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable. The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack.
References
  • (MISC) https://discuss.kubernetes.io/t/kubernetes-security-announcement-linux-kernel-memory-cgroups-escape-via-sctp-cve-2019-3874/5594 -
  • (MISC) https://lore.kernel.org/netdev/20190401113110.GA20717@hmswarspite.think-freely.org/T/#u -
  • (MISC) https://access.redhat.com/security/cve/CVE-2019-3874 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1686373 -

14 Jun 2021, 18:15

Type Values Removed Values Added
References
  • (MISC) https://www.oracle.com/security-alerts/cpuApr2021.html -
Information

Published : 2019-03-25 19:29

Updated : 2023-12-10 12:59

NVD link : CVE-2019-3874

Mitre link : CVE-2019-3874

CVE.ORG link : CVE-2019-3874

JSON object : View

Products Affected

debian

  • debian_linux

netapp

  • snapprotect
  • solidfire
  • hci_management_node
  • active_iq_unified_manager_for_vmware_vsphere
  • cn1610
  • cn1610_firmware

redhat

  • enterprise_linux

linux

  • linux_kernel

canonical

  • ubuntu_linux
CWE
CWE-400

Uncontrolled Resource Consumption

NVD-CWE-noinfo