CVE-2019-19922
Description
kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
17- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*Range: >=11.0,<=11.70.2
- cpe:2.3:a:netapp:fas\/aff_baseboard_management_controller:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:hci_baseboard_management_controller:h610s:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:aff_baseboard_management_controller:a700:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*+ 1 more
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
- Linux/Linux kerneldescription
Patches
Vulnerability mechanics
References
9- cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9nvdMailing ListPatchVendor Advisory
- git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/nvdMailing ListPatchVendor Advisory
- github.com/kubernetes/kubernetes/issues/67577nvdIssue TrackingPatchThird Party Advisory
- github.com/torvalds/linux/commit/de53fd7aedb100f03e5d2231cfce0e4993282425nvdPatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.htmlnvdPatchThird Party Advisory
- relistan.com/the-kernel-may-be-slowing-down-your-appnvdExploitThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlnvdMailing ListThird Party Advisory
- security.netapp.com/advisory/ntap-20200204-0002/nvdThird Party Advisory
- usn.ubuntu.com/4226-1/nvdThird Party Advisory
News mentions
0No linked articles in our index yet.