Sign-up

ID

VAR-201911-1639


CVE

CVE-2019-0148


TITLE

Intel(R) Ethernet 700 Series Controller Vulnerabilities related to resource exhaustion

Trust: 0.8

sources: JVNDB: JVNDB-2019-012078

DESCRIPTION

Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access. Intel(R) Ethernet 700 Series Controller Contains a resource exhaustion vulnerability.Denial of service (DoS) May be in a state. Intel Ethernet 700 Series Controllers is a network adapter product from Intel Corporation. An attacker could exploit this vulnerability to cause a denial of service. This vulnerability stems from improper management of system resources (such as memory, disk space, files, etc.) by network systems or products. ========================================================================== Ubuntu Security Notice USN-4681-1 January 06, 2021 linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 14.04 ESM Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-kvm: Linux kernel for cloud environments - linux-raspi2: Linux kernel for Raspberry Pi (V8) systems - linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors - linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty Details: Ryan Hall discovered that the Intel 700 Series Ethernet Controllers driver in the Linux kernel did not properly deallocate memory in some conditions. (CVE-2019-0148) It was discovered that the console keyboard driver in the Linux kernel contained a race condition. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-25656) Minh Yuan discovered that the tty driver in the Linux kernel contained race conditions when handling fonts. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2020-25668) Jinoh Kang discovered that the Xen event channel infrastructure in the Linux kernel contained a race condition. (CVE-2020-27675) Minh Yuan discovered that the framebuffer console driver in the Linux kernel did not properly handle fonts in some conditions. (CVE-2020-28974) It was discovered that Power 9 processors could be coerced to expose information from the L1 cache in certain situations. A local attacker could use this to expose sensitive information. (CVE-2020-4788) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: linux-image-4.4.0-1085-kvm 4.4.0-1085.94 linux-image-4.4.0-1119-aws 4.4.0-1119.133 linux-image-4.4.0-1143-raspi2 4.4.0-1143.153 linux-image-4.4.0-1147-snapdragon 4.4.0-1147.157 linux-image-4.4.0-198-generic 4.4.0-198.230 linux-image-4.4.0-198-generic-lpae 4.4.0-198.230 linux-image-4.4.0-198-lowlatency 4.4.0-198.230 linux-image-4.4.0-198-powerpc-e500mc 4.4.0-198.230 linux-image-4.4.0-198-powerpc-smp 4.4.0-198.230 linux-image-4.4.0-198-powerpc64-emb 4.4.0-198.230 linux-image-4.4.0-198-powerpc64-smp 4.4.0-198.230 linux-image-aws 4.4.0.1119.124 linux-image-generic 4.4.0.198.204 linux-image-generic-lpae 4.4.0.198.204 linux-image-kvm 4.4.0.1085.83 linux-image-lowlatency 4.4.0.198.204 linux-image-powerpc-e500mc 4.4.0.198.204 linux-image-powerpc-smp 4.4.0.198.204 linux-image-powerpc64-emb 4.4.0.198.204 linux-image-powerpc64-smp 4.4.0.198.204 linux-image-raspi2 4.4.0.1143.143 linux-image-snapdragon 4.4.0.1147.139 linux-image-virtual 4.4.0.198.204 Ubuntu 14.04 ESM: linux-image-4.4.0-1083-aws 4.4.0-1083.87 linux-image-4.4.0-198-generic 4.4.0-198.230~14.04.1 linux-image-4.4.0-198-generic-lpae 4.4.0-198.230~14.04.1 linux-image-4.4.0-198-lowlatency 4.4.0-198.230~14.04.1 linux-image-4.4.0-198-powerpc-e500mc 4.4.0-198.230~14.04.1 linux-image-4.4.0-198-powerpc-smp 4.4.0-198.230~14.04.1 linux-image-4.4.0-198-powerpc64-emb 4.4.0-198.230~14.04.1 linux-image-4.4.0-198-powerpc64-smp 4.4.0-198.230~14.04.1 linux-image-aws 4.4.0.1083.80 linux-image-generic-lpae-lts-xenial 4.4.0.198.173 linux-image-generic-lts-xenial 4.4.0.198.173 linux-image-lowlatency-lts-xenial 4.4.0.198.173 linux-image-powerpc-e500mc-lts-xenial 4.4.0.198.173 linux-image-powerpc-smp-lts-xenial 4.4.0.198.173 linux-image-powerpc64-emb-lts-xenial 4.4.0.198.173 linux-image-powerpc64-smp-lts-xenial 4.4.0.198.173 linux-image-virtual-lts-xenial 4.4.0.198.173 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://usn.ubuntu.com/4681-1 CVE-2019-0148, CVE-2020-25656, CVE-2020-25668, CVE-2020-27675, CVE-2020-28974, CVE-2020-4788 Package Information: https://launchpad.net/ubuntu/+source/linux/4.4.0-198.230 https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1119.133 https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1085.94 https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1143.153 https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1147.157

Trust: 2.34

sources: NVD: CVE-2019-0148 // JVNDB: JVNDB-2019-012078 // CNVD: CNVD-2019-41459 // VULHUB: VHN-140179 // PACKETSTORM: 160825

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-41459

AFFECTED PRODUCTS

vendor:intelmodel:ethernet controller 710-bm1scope:ltversion:7.0

Trust: 1.8

vendor:intelmodel:ethernet controller x710-at2scope:ltversion:7.0

Trust: 1.8

vendor:intelmodel:ethernet controller x710-bm2scope:ltversion:7.0

Trust: 1.8

vendor:intelmodel:ethernet controller x710-tm4scope:ltversion:7.0

Trust: 1.8

vendor:intelmodel:ethernet controller xxv710-am1scope:ltversion:7.0

Trust: 1.8

vendor:intelmodel:ethernet controller xxv710-am2scope:ltversion:7.0

Trust: 1.8

vendor:intelmodel:ethernet 700 series softwarescope:ltversion:24.0

Trust: 1.0

vendor:intelmodel:ethernet 700 series softwarescope: - version: -

Trust: 0.8

vendor:intelmodel:ethernet series controllerscope:eqversion:700<7.0

Trust: 0.6

sources: CNVD: CNVD-2019-41459 // JVNDB: JVNDB-2019-012078 // NVD: CVE-2019-0148

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-0148
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-0148
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2019-41459
value: LOW

Trust: 0.6

CNNVD: CNNVD-201911-555
value: MEDIUM

Trust: 0.6

VULHUB: VHN-140179
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2019-0148
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:N/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-41459
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:N/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-140179
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:N/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-0148
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2019-0148
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2019-41459 // VULHUB: VHN-140179 // JVNDB: JVNDB-2019-012078 // CNNVD: CNNVD-201911-555 // NVD: CVE-2019-0148

PROBLEMTYPE DATA

problemtype:CWE-772

Trust: 1.1

problemtype:CWE-400

Trust: 0.8

sources: VULHUB: VHN-140179 // JVNDB: JVNDB-2019-012078 // NVD: CVE-2019-0148

THREAT TYPE

local

Trust: 0.7

sources: PACKETSTORM: 160825 // CNNVD: CNNVD-201911-555

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201911-555

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-012078

PATCH
title:INTEL-SA-00255url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
Trust: 0.8
title:Patch for Intel Ethernet 700 Series Controllers Resource Leak Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/191091
Trust: 0.6
title:Intel Ethernet 700 Series Controllers i40e driver Remediation of resource management error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=104679
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-41459 // 
            
            
            
            JVNDB: JVNDB-2019-012078 // 
            
            
            
            CNNVD: CNNVD-201911-555

EXTERNAL IDS
db:NVDid:CVE-2019-0148
Trust: 3.2
db:PACKETSTORMid:160825
Trust: 0.8
db:JVNid:JVNVU90354904
Trust: 0.8
db:JVNDBid:JVNDB-2019-012078
Trust: 0.8
db:CNNVDid:CNNVD-201911-555
Trust: 0.7
db:CNVDid:CNVD-2019-41459
Trust: 0.6
db:AUSCERTid:ESB-2021.0071
Trust: 0.6
db:LENOVOid:LEN-27715
Trust: 0.6
db:VULHUBid:VHN-140179
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-41459 // 
            
            
            
            VULHUB: VHN-140179 // 
            
            
            
            JVNDB: JVNDB-2019-012078 // 
            
            
            
            PACKETSTORM: 160825 // 
            
            
            
            CNNVD: CNNVD-201911-555 // 
            
            
            
            NVD: CVE-2019-0148

REFERENCES
url:https://nvd.nist.gov/vuln/detail/cve-2019-0148
Trust: 2.1
url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0148
Trust: 0.8
url:https://jvn.jp/vu/jvnvu90354904/
Trust: 0.8
url:https://packetstormsecurity.com/files/160825/ubuntu-security-notice-usn-4681-1.html
Trust: 0.6
url:https://vigilance.fr/vulnerability/intel-ethernet-700-series-controllers-multiple-vulnerabilities-30850
Trust: 0.6
url:https://support.lenovo.com/us/en/product_security/len-27715
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.0071/
Trust: 0.6
url:https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1147.157
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1119.133
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-27675
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/linux/4.4.0-198.230
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-28974
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1143.153
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-25656
Trust: 0.1
url:https://usn.ubuntu.com/4681-1
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1085.94
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-4788
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-25668
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-41459 // 
            
            
            
            VULHUB: VHN-140179 // 
            
            
            
            JVNDB: JVNDB-2019-012078 // 
            
            
            
            PACKETSTORM: 160825 // 
            
            
            
            CNNVD: CNNVD-201911-555 // 
            
            
            
            NVD: CVE-2019-0148

CREDITS
Ubuntu
Trust: 0.7
sources:
            
            
            PACKETSTORM: 160825 // 
            
            
            
            CNNVD: CNNVD-201911-555

SOURCES
db:CNVDid:CNVD-2019-41459
db:VULHUBid:VHN-140179
db:JVNDBid:JVNDB-2019-012078
db:PACKETSTORMid:160825
db:CNNVDid:CNNVD-201911-555
db:NVDid:CVE-2019-0148

LAST UPDATE DATE
2024-11-23T20:45:01.041000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-41459date:2019-11-20T00:00:00
db:VULHUBid:VHN-140179date:2020-08-24T00:00:00
db:JVNDBid:JVNDB-2019-012078date:2019-11-25T00:00:00
db:CNNVDid:CNNVD-201911-555date:2021-01-07T00:00:00
db:NVDid:CVE-2019-0148date:2024-11-21T04:16:19.973

SOURCES RELEASE DATE
db:CNVDid:CNVD-2019-41459date:2019-11-20T00:00:00
db:VULHUBid:VHN-140179date:2019-11-14T00:00:00
db:JVNDBid:JVNDB-2019-012078date:2019-11-25T00:00:00
db:PACKETSTORMid:160825date:2021-01-06T15:58:17
db:CNNVDid:CNNVD-201911-555date:2019-11-12T00:00:00
db:NVDid:CVE-2019-0148date:2019-11-14T19:15:12.457