CVE-2019-3874

Published: 25 March 2019

The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable.

From the Ubuntu Security Team

Matteo Croce, Natale Vinto, and Andrea Spagnolo discovered that the cgroups subsystem of the Linux kernel did not properly account for SCTP socket buffers. A local attacker could use this to cause a denial of service (system crash).

Notes

As of 2019-04-01, a patch series that addresses this issue has been
submitted for upstream review but it has not yet been ACK'ed or merged.
As of 2019-04-09, the patch series is still in the same state.

Status

Severity score breakdown

References

• https://lore.kernel.org/netdev/cover.1554022192.git.lucien.xin@gmail.com/
• https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=1033990ac5b2ab6cee93734cb6d301aa3a35bcaa
• https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=9dde27de3e5efa0d032f3c891a0ca833a0d31911
• https://ubuntu.com/security/notices/USN-3979-1
• https://ubuntu.com/security/notices/USN-3980-1
• https://ubuntu.com/security/notices/USN-3981-1
• https://ubuntu.com/security/notices/USN-3982-1
• https://ubuntu.com/security/notices/USN-3982-2
• https://ubuntu.com/security/notices/USN-3980-2
• https://ubuntu.com/security/notices/USN-3981-2
• https://www.cve.org/CVERecord?id=CVE-2019-3874
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=1686373