CVE-2019-20096 : In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denia

In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b.

Published 2019-12-30 05:15:12

Updated 2023-01-20 20:36:59

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Threat overview for CVE-2019-20096

Top countries where our scanners detected CVE-2019-20096

Top open port discovered on systems with this issue 49152

IPs affected by CVE-2019-20096 20,523

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2019-20096!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2019-20096

Probability of exploitation activity in the next 30 days: 0.05%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 12 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2019-20096

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.9	MEDIUM	AV:L/AC:L/Au:N/C:N/I:N/A:C	3.9	6.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2019-20096

CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-20096

https://usn.ubuntu.com/4286-1/

USN-4286-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://usn.ubuntu.com/4287-2/

USN-4287-2: Linux kernel (Azure) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1

Release Notes;Vendor Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html

[SECURITY] [DLA 2114-1] linux-4.9 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1d3ff0950e2b40dc861b1739029649d03f591820

kernel/git/torvalds/linux.git - Linux kernel source tree
Patch;Vendor Advisory
https://usn.ubuntu.com/4285-1/

USN-4285-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://usn.ubuntu.com/4287-1/

USN-4287-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html

[security-announce] openSUSE-SU-2020:0336-1: important: Security update
Broken Link;Third Party Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html

Kernel Live Patch Security Notice LSN-0063-1 ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
https://usn.ubuntu.com/4286-2/

USN-4286-2: Linux kernel (Xenial HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2019-20096