What’s Vulnerable › Vulnerabilities

CVE-2019-17075

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-10-01 · updated 2026-06-17

Description

An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.

Affected products

• Linux kernel: from 2.6.35 before 4.4.198; from 4.5.0 before 4.9.198; from 4.10 before 4.14.151; from 4.15 before 4.19.81; from 4.20 before 5.3.8 — fixed in 4.14.151, 4.19.81, 4.4.198, 4.9.198, 5.3.8

How to fix

Upgrade to a fixed version: Linux kernel 4.14.151, 4.19.81, 4.4.198, 4.9.198. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
• https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
• https://lore.kernel.org/lkml/20191001165611.GA3542072%40kroah.com
• https://seclists.org/bugtraq/2019/Nov/11
• https://usn.ubuntu.com/4208-1/
• https://usn.ubuntu.com/4210-1/
• https://usn.ubuntu.com/4211-1/
• https://usn.ubuntu.com/4211-2/
• https://usn.ubuntu.com/4226-1/
• https://www.oracle.com/security-alerts/cpuApr2021.html
• http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
• https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html

Get alerted when CVE-2019-17075 or the next vulnerability affects your stack