A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length which causes the read beyond the buffer boundaries, in certain cases causing a memory access fault and a system halt by accessing invalid memory address. This issue only affects kernel version 3.10.x as shipped with Red Hat Enterprise Linux 7.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | centos-upgrade-kernelcentos-upgrade-kernel-rt | Aug 28, 2019 | Jan 3, 2019 |
| Debian | debian-upgrade-linux | Jul 30, 2024 | Jan 3, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-kernel | Aug 15, 2019 | Dec 21, 2018 |
| Redhat_linux | — | redhat-upgrade-kernelredhat-upgrade-kernel-rt | Aug 7, 2019 | Jan 3, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub