VDB

CVE-2019-3896

CVE-2019-3896 PUBLISHED CVSS 7.800000190734863 HIGH

A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS).

EPSS 0.42% · 33.6th percentile

Risk Scores

CVSS 3.0
7.800000190734863
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.42%
33.6th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:14.04:LTSlinux-lts-xenial4.4.0-13.29~14.04.1, 4.4.0-15.31~14.04.1, 4.4.0-18.34~14.04.1
Ubuntu:Pro:14.04:LTSlinux-azure*, 4.15.0-1023.24~14.04.1, 4.15.0-1031.32~14.04.1
Ubuntu:Pro:14.04:LTSlinux-aws4.4.0-1094.99, 4.4.0-1002.2, 4.4.0-1003.3
Ubuntu:Pro:14.04:LTSlinux3.13.0-139.188, 3.13.0-141.190, 3.13.0-142.191

Timeline

  • Jan 16, 2018 PoC Published
  • Jun 18, 2019 CVE Published
  • Apr 14, 2021 EPSS Score
  • May 28, 2021 PoC Published
  • Jun 23, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Oct 27, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Mar 2, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 4, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›