{"id":"CVE-2019-14821","state":"PUBLISHED","title":"An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It op","description":"An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.","publishedAt":"2019-09-19T17:37:24.000Z","updatedAt":"2024-08-05T00:26:39.131Z","severity":{"score":7.5,"label":"High","version":"3.0","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["Linux Kernel"],"affected":[{"vendor":"Linux","product":"Kernel","versions":[{"version":"all through 5.3","status":"affected"}]}],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14821","http://www.openwall.com/lists/oss-security/2019/09/20/1","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZQQQANZWQMPILZV7OTS3RGGRLLE2Q7/","https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html","https://seclists.org/bugtraq/2019/Sep/41","https://www.debian.org/security/2019/dsa-4531","https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/","https://security.netapp.com/advisory/ntap-20191004-0001/","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html","https://usn.ubuntu.com/4157-1/","https://usn.ubuntu.com/4162-1/","https://usn.ubuntu.com/4157-2/","https://usn.ubuntu.com/4163-1/","https://usn.ubuntu.com/4163-2/","https://usn.ubuntu.com/4162-2/","http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html","https://access.redhat.com/errata/RHSA-2019:3309","https://access.redhat.com/errata/RHSA-2019:3517","https://seclists.org/bugtraq/2019/Nov/11","http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html","https://access.redhat.com/errata/RHSA-2019:3978","https://access.redhat.com/errata/RHSA-2019:3979","https://access.redhat.com/errata/RHSA-2019:4154","https://access.redhat.com/errata/RHSA-2019:4256","https://access.redhat.com/errata/RHSA-2020:0027","https://access.redhat.com/errata/RHSA-2020:0204","https://www.oracle.com/security-alerts/cpuapr2020.html"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T19:45:30.451Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/14xxx/CVE-2019-14821.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-14821","state":"PUBLISHED","datePublished":"2019-09-19T17:37:24.000Z","dateUpdated":"2024-08-05T00:26:39.131Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2019-08-10T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system."}],"affected":[{"vendor":"Linux","product":"Kernel","versions":[{"version":"all through 5.3","status":"affected"}]}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14821","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2019/09/20/1","name":"[oss-security] 20190920 CVE-2019-14821 Kernel: KVM: OOB memory access via mmio ring buffer","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZQQQANZWQMPILZV7OTS3RGGRLLE2Q7/","name":"FEDORA-2019-15e141c6a7","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html","name":"[debian-lts-announce] 20190925 [SECURITY] [DLA 1930-1] linux security update","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://seclists.org/bugtraq/2019/Sep/41","name":"20190925 [SECURITY] [DSA 4531-1] linux security update","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"https://www.debian.org/security/2019/dsa-4531","name":"DSA-4531","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html","name":"[debian-lts-announce] 20191001 [SECURITY] [DLA 1940-1] linux-4.9 security update","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/","name":"FEDORA-2019-a570a92d5a","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://security.netapp.com/advisory/ntap-20191004-0001/","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html","name":"openSUSE-SU-2019:2307","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html","name":"openSUSE-SU-2019:2308","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://usn.ubuntu.com/4157-1/","name":"USN-4157-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://usn.ubuntu.com/4162-1/","name":"USN-4162-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://usn.ubuntu.com/4157-2/","name":"USN-4157-2","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://usn.ubuntu.com/4163-1/","name":"USN-4163-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://usn.ubuntu.com/4163-2/","name":"USN-4163-2","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://usn.ubuntu.com/4162-2/","name":"USN-4162-2","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3309","name":"RHSA-2019:3309","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3517","name":"RHSA-2019:3517","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://seclists.org/bugtraq/2019/Nov/11","name":"20191108 [slackware-security] Slackware 14.2 kernel (SSA:2019-311-01)","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3978","name":"RHSA-2019:3978","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3979","name":"RHSA-2019:3979","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4154","name":"RHSA-2019:4154","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4256","name":"RHSA-2019:4256","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0027","name":"RHSA-2020:0027","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0204","name":"RHSA-2020:0204","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"CWE-787","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","dateUpdated":"2020-04-15T21:06:51.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14821","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2019/09/20/1","name":"[oss-security] 20190920 CVE-2019-14821 Kernel: KVM: OOB memory access via mmio ring buffer","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZQQQANZWQMPILZV7OTS3RGGRLLE2Q7/","name":"FEDORA-2019-15e141c6a7","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html","name":"[debian-lts-announce] 20190925 [SECURITY] [DLA 1930-1] linux security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://seclists.org/bugtraq/2019/Sep/41","name":"20190925 [SECURITY] [DSA 4531-1] linux security update","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://www.debian.org/security/2019/dsa-4531","name":"DSA-4531","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html","name":"[debian-lts-announce] 20191001 [SECURITY] [DLA 1940-1] linux-4.9 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3QNMPENPFEGVTOFPSNOBL7JEIJS25P/","name":"FEDORA-2019-a570a92d5a","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20191004-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html","name":"openSUSE-SU-2019:2307","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html","name":"openSUSE-SU-2019:2308","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://usn.ubuntu.com/4157-1/","name":"USN-4157-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://usn.ubuntu.com/4162-1/","name":"USN-4162-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://usn.ubuntu.com/4157-2/","name":"USN-4157-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://usn.ubuntu.com/4163-1/","name":"USN-4163-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://usn.ubuntu.com/4163-2/","name":"USN-4163-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://usn.ubuntu.com/4162-2/","name":"USN-4162-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3309","name":"RHSA-2019:3309","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3517","name":"RHSA-2019:3517","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://seclists.org/bugtraq/2019/Nov/11","name":"20191108 [slackware-security] Slackware 14.2 kernel (SSA:2019-311-01)","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3978","name":"RHSA-2019:3978","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3979","name":"RHSA-2019:3979","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4154","name":"RHSA-2019:4154","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4256","name":"RHSA-2019:4256","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0027","name":"RHSA-2020:0027","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0204","name":"RHSA-2020:0204","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T00:26:39.131Z"}}]}}}