VULNERABILITY

Oracle Linux: CVE-2019-12378: ELSA-2019-4729: Unbreakable Enterprise kernel security update (IMPORTANT) (Multiple Advisories)

Try Surface Command Get a continuous 360° view of your attack surface
Back to Search

Oracle Linux: CVE-2019-12378: ELSA-2019-4729: Unbreakable Enterprise kernel security update (IMPORTANT) (Multiple Advisories)

Severity
6
CVSS
(AV:A/AC:L/Au:S/C:N/I:N/A:C)
Published
05/25/2019
Created
07/31/2019
Added
07/31/2019
Modified
01/23/2025

Description

An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: This has been disputed as not an issue A flaw was discovered in the Linux kernel's implementation of IPv6 router advertisement handling. Under low-memory-free conditions a kmalloc request may fail leaving the system to crash shortly after with a null pointer dereference. The attacker must be able to send IPv6 RA packets to this host, most routers will not forward these packets requiring the attacker to be on the local network.

Solution(s)

  • oracle-linux-upgrade-kernel-uek

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
  • Lightweight Endpoint Agent
  • Live Dashboards
  • Real Risk Prioritization
  • IT-Integrated Remediation Projects
  • Cloud, Virtual, and Container Assessment
  • Integrated Threat Feeds
  • Easy-to-Use RESTful API
  • Automation-Assisted Patching
  • Automated Containment
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;