What’s Vulnerable › Vulnerabilities
CVE-2019-14821
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-09-19 · updated 2026-06-17
- Weakness: CWE-787
Description
An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.
Affected products
- Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 19.04
- Debian Linux: 8.0, 9.0, 10.0
- Fedoraproject Fedora: 29, 30
- Linux kernel: from 2.6.27 through 3.15.10; from 3.16 before 3.16.74; from 4.4 before 4.4.194; from 4.9 before 4.9.194; from 4.14 before 4.14.146; from 4.19 before 4.19.75 — fixed in 3.16.74, 4.14.146, 4.19.75, 4.4.194, 4.9.194, 5.2.17
- NetApp Aff A700S Firmware: all versions
- NetApp Data Availability Services: all versions
- NetApp H300E Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410C Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500E Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H610S Firmware: all versions
- NetApp H700E Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp Hci Management Node: all versions
- NetApp Solidfire: all versions
- openSUSE Leap: 15.0, 15.1
- Oracle Corporation SD-WAN Edge: 7.3, 8.0, 8.1, 8.2
- Red Hat Enterprise Linux: 8.0
- RedHat Enterprise Linux Desktop: 6.0, 7.0
- RedHat Enterprise Linux Eus: 7.7
- RedHat Enterprise Linux For Real Time: 7, 8
- RedHat Enterprise Linux Server: 6.0, 7.0
- RedHat Enterprise Linux Server Aus: 7.7
- RedHat Enterprise Linux Server Tus: 7.7
- RedHat Enterprise Linux Workstation: 6.0, 7.0
- RedHat Virtualization Host: 4.0
How to fix
Upgrade to a fixed version: Linux kernel 3.16.74, 4.14.146, 4.19.75, 4.4.194. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
- http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- http://www.openwall.com/lists/oss-security/2019/09/20/1
- https://access.redhat.com/errata/RHSA-2019:3309
- https://access.redhat.com/errata/RHSA-2019:3517
- https://access.redhat.com/errata/RHSA-2019:3978
- https://access.redhat.com/errata/RHSA-2019:3979
- https://access.redhat.com/errata/RHSA-2019:4154
- https://access.redhat.com/errata/RHSA-2019:4256
- https://access.redhat.com/errata/RHSA-2020:0027
Get alerted when CVE-2019-14821 or the next vulnerability affects your stack