Strix
26.1K

CVE-2019-19922

MEDIUMCVSS 5.5/10EPSS 0.95%

Last modified

CVE-2019-19922 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. EPSS estimates a 0.95% chance of exploitation in the next 30 days.

Description

kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)

Metrics

CVSS 3.1
5.5/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
0.95%

56.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
LinuxLinux Kernel< 5.3.9
OracleSd-Wan Edge8.2
CanonicalUbuntu Linux18.04
CanonicalUbuntu Linux19.04
DebianDebian Linux8.0
NetappActive Iq Unified ManagerAll versions
NetappCloud BackupAll versions
NetappData Availability ServicesAll versions
NetappE-Series Santricity Os Controller>= 11.0, <= 11.70.2
NetappFas\/Aff Baseboard Management ControllerAll versions
NetappHci Baseboard Management Controllerh610s
NetappSolidfire \& Hci Management NodeAll versions
NetappSteelstore Cloud Integrated StorageAll versions
NetappAff Baseboard Management Controllera700
NetappSolidfire Baseboard Management ControllerAll versions

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-19922?
kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)
How severe is CVE-2019-19922?
CVE-2019-19922 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.95% probability of exploitation in the next 30 days.
How do I fix CVE-2019-19922?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-19922?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST