CVE-2019-3837: The Linux Foundation kernel, състезание за ресурс

Описание

Оригинално описание

It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.

Засегнати продукти

• The Linux Foundation kernel: 2.6.32 as shipped in rhel-6

Вид слабост

• CWE-362 Неправилна синхронизация при споделен ресурс (Race Condition)

История

Други уязвимости в The Linux Foundation kernel

• 6.1CVE-2020-10751
• 7.0CVE-2019-3896
• 4.7CVE-2019-3882
• 5.6CVE-2019-3901
• 6.7CVE-2019-3887

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2019-3837
• https://nvd.nist.gov/vuln/detail/CVE-2019-3837
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3837