Vulnerability Description
An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 2.6.34, < 3.16.72 |
| Fedoraproject | Fedora | 29 |
| Redhat | Enterprise Linux | 6.0 |
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 16.04 |
| Netapp | Active Iq Unified Manager For Vmware Vsphere | >= 9.5 |
| Netapp | Hci Management Node | - |
| Netapp | Snapprotect | - |
| Netapp | Solidfire | - |
| Netapp | Storage Replication Adapter For Clustered Data Ontap For Vmware Vsphere | >= 7.2 |
| Netapp | Vasa Provider For Clustered Data Ontap | >= 7.2 |
| Netapp | Virtual Storage Console For Vmware Vsphere | >= 7.2 |
| Netapp | Cn1610 Firmware | - |
| Netapp | Cn1610 | - |
| Oracle | Sd-Wan Edge | 8.2 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-SlackwarPatchThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/108076Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2019:1973Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2029Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2043Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3220Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3309Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3517Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3836Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3967Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4058Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0204Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3900Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00016.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00017.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2019-3900?
CVE-2019-3900 is a vulnerability with a CVSS score of 7.7 (HIGH). An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets fa...
How severe is CVE-2019-3900?
CVE-2019-3900 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-3900?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Fedoraproject Fedora, Redhat Enterprise Linux, Debian Debian Linux, Canonical Ubuntu Linux.