CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
91.2%
Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux
kernel did not properly perform bounds checking, leading to a heap
overflow. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2019-14814,
CVE-2019-14815, CVE-2019-14816)
Matt Delco discovered that the KVM hypervisor implementation in the Linux
kernel did not properly perform bounds checking when handling coalesced
MMIO write operations. A local attacker with write access to /dev/kvm could
use this to cause a denial of service (system crash). (CVE-2019-14821)
Hui Peng and Mathias Payer discovered that the 91x Wi-Fi driver in the
Linux kernel did not properly handle error conditions on initialization,
leading to a double-free vulnerability. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-15504)
It was discovered that the Technisat DVB-S/S2 USB device driver in the
Linux kernel contained a buffer overread. A physically proximate attacker
could use this to cause a denial of service (system crash) or possibly
expose sensitive information. (CVE-2019-15505)
Brad Spengler discovered that a Spectre mitigation was improperly
implemented in the ptrace susbsystem of the Linux kernel. A local attacker
could possibly use this to expose sensitive information. (CVE-2019-15902)
It was discovered that the IPv6 RDS implementation in the Linux kernel did
not properly initialize fields in a data structure returned to user space.
A local attacker could use this to expose sensitive information (kernel
memory). Please note that the RDS protocol is disabled via blocklist in
Ubuntu by default. (CVE-2019-16714)
It was discovered that an integer overflow existed in the Binder
implementation of the Linux kernel, leading to a buffer overflow. A local
attacker could use this to escalate privileges. (CVE-2019-2181)
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Ubuntu | 19.04 | noarch | linux-image-5.0.0-1019-aws | < 5.0.0-1019.21 | UNKNOWN |
Ubuntu | 19.04 | noarch | linux-aws-headers-5.0.0-1019 | < 5.0.0-1019.21 | UNKNOWN |
Ubuntu | 19.04 | noarch | linux-aws-tools-5.0.0-1019 | < 5.0.0-1019.21 | UNKNOWN |
Ubuntu | 19.04 | noarch | linux-buildinfo-5.0.0-1019-aws | < 5.0.0-1019.21 | UNKNOWN |
Ubuntu | 19.04 | noarch | linux-headers-5.0.0-1019-aws | < 5.0.0-1019.21 | UNKNOWN |
Ubuntu | 19.04 | noarch | linux-image-5.0.0-1019-aws-dbgsym | < 5.0.0-1019.21 | UNKNOWN |
Ubuntu | 19.04 | noarch | linux-modules-5.0.0-1019-aws | < 5.0.0-1019.21 | UNKNOWN |
Ubuntu | 19.04 | noarch | linux-modules-extra-5.0.0-1019-aws | < 5.0.0-1019.21 | UNKNOWN |
Ubuntu | 19.04 | noarch | linux-tools-5.0.0-1019-aws | < 5.0.0-1019.21 | UNKNOWN |
Ubuntu | 19.04 | noarch | linux-image-5.0.0-1020-kvm | < 5.0.0-1020.21 | UNKNOWN |
ubuntu.com/security/CVE-2019-14814
ubuntu.com/security/CVE-2019-14815
ubuntu.com/security/CVE-2019-14816
ubuntu.com/security/CVE-2019-14821
ubuntu.com/security/CVE-2019-15504
ubuntu.com/security/CVE-2019-15505
ubuntu.com/security/CVE-2019-15902
ubuntu.com/security/CVE-2019-16714
ubuntu.com/security/CVE-2019-2181
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
91.2%