CVE-2019-19922
kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)
EPSS 0.95% · 59.6th percentile
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:20.04:LTS | linux-raspi2 | 0, 5.3.0-1007.8, 5.3.0-1014.16 |
| Ubuntu:18.04:LTS | linux-azure-edge | 4.18.0-1006.6~18.04.1, 0, * |
| Ubuntu:16.04:LTS | linux-oracle | *, 0, 4.15.0-1007.9~16.04.1 |
| Ubuntu:18.04:LTS | linux-oem-osp1 | 5.0.0-1027.31, 5.0.0-1010.11, 5.0.0-1024.27 |
| Ubuntu:18.04:LTS | linux-azure | 4.15.0-1018.18, 0, 4.15.0-1002.2 |
| Ubuntu:18.04:LTS | linux-aws | 4.15.0-1051.53, 4.15.0-1050.52, 4.15.0-1048.50 |
| Ubuntu:18.04:LTS | linux-oracle-5.0 | 0, *, * |
| Ubuntu:22.04:LTS | linux-realtime | 5.15.0-1032.35, 0 |
| Ubuntu:Pro:14.04:LTS | linux-azure | *, 4.15.0-1061.66~14.04.1, * |
| Ubuntu:18.04:LTS | linux-azure-5.3 | 0, 5.3.0-1007.8~18.04.1 |
| Ubuntu:18.04:LTS | linux-gcp | 4.15.0-1026.27, 4.15.0-1028.29, 4.15.0-1029.31 |
| Ubuntu:18.04:LTS | linux-hwe | 4.18.0-16.17~18.04.1, 0, 4.18.0-13.14~18.04.1 |
| Ubuntu:18.04:LTS | linux-oem | 4.15.0-1059.68, 4.15.0-1057.66, 4.15.0-1043.48 |
| Ubuntu:18.04:LTS | linux-gke-5.0 | 5.0.0-1017.17~18.04.1, 5.0.0-1022.22~18.04.3, 5.0.0-1023.23~18.04.2 |
| Ubuntu:16.04:LTS | linux-aws-hwe | 4.15.0-1050.52~16.04.1, 0, 4.15.0-1030.31~16.04.1 |
| Ubuntu:18.04:LTS | linux-kvm | 4.15.0-1028.28, 4.15.0-1046.46, 4.15.0-1044.44 |
| Ubuntu:18.04:LTS | linux-snapdragon | 4.15.0-1064.71, 0, 4.4.0-1077.82 |
| Ubuntu:20.04:LTS | linux-azure-fde | 5.4.0-1068.71+cvm1.1, 5.4.0-1067.70+cvm1.1, 5.4.0-1065.68+cvm2.1 |
| Ubuntu:20.04:LTS | linux-gke | 5.4.0-1041.43, 5.4.0-1081.87, 5.4.0-1080.86 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | 0, 5.15.0-1073.75 |
…and 15 more
Timeline
- Dec 22, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 29, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 3, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 5, 2022 EPSS Score
- Sep 9, 2022 EPSS Score
- Nov 11, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-19922 third-party-advisory
- https://git.kernel.org/linus/de53fd7aedb100f03e5d2231cfce0e4993282425 third-party-advisory
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9 third-party-advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=de53fd7aedb100f03e5d2231cfce0e4993282425 third-party-advisory
- https://github.com/kubernetes/kubernetes/issues/67577 third-party-advisory
- https://github.com/torvalds/linux/commit/de53fd7aedb100f03e5d2231cfce0e4993282425 third-party-advisory
- https://relistan.com/the-kernel-may-be-slowing-down-your-app third-party-advisory
- https://ubuntu.com/security/notices/USN-4226-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-19922 third-party-advisory