Description

A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Linux Kernel	Linux kernel	from version 2.6.34 to 5.2.x

References

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlMailing List, Third Party Advisory
http://packetstormsecurity.com/files/154572/Kernel-Live-Patch-Security-Notice-LSN-0056-1.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlThird Party Advisory, VDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-qemu-enThird Party Advisory
http://www.openwall.com/lists/oss-security/2019/09/24/1Mailing List
http://www.openwall.com/lists/oss-security/2019/10/03/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/09/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/09/7Mailing List, Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:2824Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2827Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2828Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2829Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2830Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2854Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2862Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2863Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2864Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2865Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2866Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2867Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2869Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2889Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2899Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2900Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2901Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2924Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14835Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00025.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00000.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQFY6JYFIQ2VFQ7QCSXPWTUL5ZDNCJL5/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/Mailing List
https://seclists.org/bugtraq/2019/Nov/11Issue Tracking, Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/41Issue Tracking, Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20191031-0005/Third Party Advisory
https://usn.ubuntu.com/4135-1/Third Party Advisory
https://usn.ubuntu.com/4135-2/Third Party Advisory
https://www.debian.org/security/2019/dsa-4531Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/09/17/1Exploit, Mailing List, Patch, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlMailing List, Third Party Advisory
http://packetstormsecurity.com/files/154572/Kernel-Live-Patch-Security-Notice-LSN-0056-1.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlThird Party Advisory, VDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-qemu-enThird Party Advisory
http://www.openwall.com/lists/oss-security/2019/09/24/1Mailing List
http://www.openwall.com/lists/oss-security/2019/10/03/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/09/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/09/7Mailing List, Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:2824Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2827Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2828Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2829Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2830Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2854Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2862Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2863Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2864Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2865Third Party Advisory

Timeline

Published: Sep 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified