CVE-2019-19044

Q: What is the severity of CVE-2019-19044?

CVE-2019-19044 has a CVSS score of 7.5 (HIGH). This vulnerability involves two memory leaks in the Linux kernel's v3d GPU driver that allow attackers to cause denial of service through memory exhaustion. It affects Linux systems with vulnerable kernel versions that use the v3d graphics driver. The vulnerability requires local access to trigger the memory leaks.

7.5 HIGH

Denial of Service

📋 TL;DR

This vulnerability involves two memory leaks in the Linux kernel's v3d GPU driver that allow attackers to cause denial of service through memory exhaustion. It affects Linux systems with vulnerable kernel versions that use the v3d graphics driver. The vulnerability requires local access to trigger the memory leaks.

💻 Affected Systems

Products:

Linux kernel

Versions: Linux kernel versions before 5.3.11

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using the v3d GPU driver (typically Broadcom VideoCore graphics). Systems without this driver or with it disabled are not vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Solidfire \& Hci Management Node by Netapp

View all CVEs affecting Solidfire \& Hci Management Node →

Solidfire Baseboard Management Controller Firmware by Netapp

View all CVEs affecting Solidfire Baseboard Management Controller Firmware →

Solidfire\, Enterprise Sds \& Hci Storage Node by Netapp

View all CVEs affecting Solidfire\, Enterprise Sds \& Hci Storage Node →

Steelstore Cloud Integrated Storage by Netapp

View all CVEs affecting Steelstore Cloud Integrated Storage →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system unavailability due to kernel memory exhaustion, potentially requiring hard reboot and causing service disruption.

🟠

Likely Case

Degraded system performance and eventual denial of service on affected systems, requiring system restart to recover.

🟢

If Mitigated

Minimal impact with proper access controls and monitoring; memory leaks would be contained to specific processes.

🌐 Internet-Facing: LOW - Requires local access to trigger the ioctl calls, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or processes with appropriate permissions can trigger the memory leaks, potentially affecting system stability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger specific ioctl failures. No public exploit code has been documented.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel 5.3.11 and later

Vendor Advisory: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11

Restart Required: Yes

Instructions:

1. Update Linux kernel to version 5.3.11 or later. 2. For distributions: Use package manager (apt-get upgrade, yum update, etc.). 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable v3d driver module

linux

Prevent loading of vulnerable v3d GPU driver if not needed

echo 'blacklist v3d' >> /etc/modprobe.d/blacklist.conf
rmmod v3d

Restrict ioctl access

linux

Limit access to the vulnerable ioctl interface using SELinux/AppArmor

# Configure appropriate SELinux/AppArmor policies to restrict v3d device access

🧯 If You Can't Patch

Implement strict access controls to limit which users/processes can access GPU devices
Monitor system memory usage and implement alerts for abnormal memory consumption patterns

🔍 How to Verify

Check if Vulnerable:

Check kernel version: uname -r and compare to 5.3.11. Also check if v3d module is loaded: lsmod | grep v3d

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is 5.3.11 or later: uname -r. Check that the fix commit 29cd13cfd762 is included in your kernel.

📡 Detection & Monitoring

Log Indicators:

Kernel oom-killer messages
System memory exhaustion warnings in syslog
Failed v3d driver initialization attempts

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("out of memory" OR "oom-killer" OR "v3d")

📊 Metadata

CVE ID: CVE-2019-19044

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

Published: November 18, 2019

Last Updated: November 21, 2024

🔗 References

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11 Release Notes,Vendor Advisory
https://github.com/torvalds/linux/commit/29cd13cfd7624726d9e6becbae9aa419ef35af7f Patch,Third Party Advisory
https://security.netapp.com/advisory/ntap-20191205-0001/ Third Party Advisory
https://usn.ubuntu.com/4225-1/ Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11 Release Notes,Vendor Advisory
https://github.com/torvalds/linux/commit/29cd13cfd7624726d9e6becbae9aa419ef35af7f Patch,Third Party Advisory
https://security.netapp.com/advisory/ntap-20191205-0001/ Third Party Advisory
https://usn.ubuntu.com/4225-1/ Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Active Iq Unified Manager by Netapp

Aff Baseboard Management Controller by Netapp

Brocade Fabric Operating System Firmware by Broadcom

Cloud Backup by Netapp

Data Availability Services by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Os Controller by Netapp

Fas\/aff Baseboard Management Controller by Netapp

Hci Baseboard Management Controller by Netapp

Hci Compute Node Firmware by Netapp

Linux Kernel by Linux

Solidfire \& Hci Management Node by Netapp

Solidfire Baseboard Management Controller Firmware by Netapp

Solidfire\, Enterprise Sds \& Hci Storage Node by Netapp

Steelstore Cloud Integrated Storage by Netapp

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable v3d driver module

Restrict ioctl access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities