Early Access — Mondoo Vulnerability Intelligence is currently in preview.

UBUNTU-CVE-2019-8980

HIGH7.5

A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.

Published Feb 21, 2019

Modified 7 months ago

Fix available

Details

A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.

Affected Packages

Ubuntu:18.04:LTSlinux

Affected versions:

4.13.0-16.194.13.0-17.204.13.0-25.294.13.0-32.354.15.0-10.114.15.0-12.134.15.0-13.144.15.0-15.164.15.0-19.204.15.0-20.21+16 more

Fixed in:

4.15.0-47.50

Ubuntu:14.04:LTSlinux

Fixed in:

3.11.0-12.19

Ubuntu:16.04:LTSlinux

Fixed in:

4.2.0-16.19

Ubuntu:14.04:LTSlinux-aws

Fixed in:

4.4.0-1002.2

Ubuntu:16.04:LTSlinux-aws

Fixed in:

4.4.0-1001.10

Ubuntu:18.04:LTSlinux-aws

Affected versions:

4.15.0-1001.14.15.0-1003.34.15.0-1005.54.15.0-1006.64.15.0-1007.74.15.0-1009.94.15.0-1010.104.15.0-1011.114.15.0-1016.164.15.0-1017.17+11 more

Fixed in:

4.15.0-1035.37

Ubuntu:16.04:LTSlinux-aws-hwe

Affected versions:

4.15.0-1030.31~16.04.14.15.0-1031.33~16.04.14.15.0-1032.34~16.04.14.15.0-1033.35~16.04.1

Fixed in:

4.15.0-1035.37~16.04.1

Ubuntu:14.04:LTSlinux-azure

Affected versions:

4.15.0-1023.24~14.04.14.15.0-1030.31~14.04.14.15.0-1031.32~14.04.14.15.0-1032.33~14.04.24.15.0-1035.36~14.04.24.15.0-1036.38~14.04.24.15.0-1037.39~14.04.24.15.0-1039.41~14.04.24.15.0-1040.44~14.04.1

Fixed in:

4.15.0-1041.45~14.04.1

Ubuntu:16.04:LTSlinux-azure

Affected versions:

4.11.0-1009.94.11.0-1011.114.11.0-1013.134.11.0-1014.144.11.0-1015.154.11.0-1016.164.13.0-1005.74.13.0-1006.84.13.0-1007.94.13.0-1009.12+22 more

Fixed in:

4.15.0-1041.45

Ubuntu:18.04:LTSlinux-azure

Affected versions:

4.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1008.84.15.0-1009.94.15.0-1012.124.15.0-1013.134.15.0-1014.144.15.0-1018.184.15.0-1019.19+13 more

Fixed in:

4.18.0-1014.14~18.04.1

Ubuntu:16.04:LTSlinux-gcp

Affected versions:

4.10.0-1004.44.10.0-1006.64.10.0-1007.74.10.0-1008.84.10.0-1009.94.13.0-1002.54.13.0-1006.94.13.0-1007.104.13.0-1008.114.13.0-1011.15+17 more

Fixed in:

4.15.0-1029.31~16.04.1

Ubuntu:18.04:LTSlinux-gcp

Affected versions:

4.15.0-1001.14.15.0-1003.34.15.0-1005.54.15.0-1006.64.15.0-1008.84.15.0-1009.94.15.0-1010.104.15.0-1014.144.15.0-1015.154.15.0-1017.18+9 more

Fixed in:

4.15.0-1029.31

Ubuntu:18.04:LTSlinux-gcp-edge

Affected versions:

4.18.0-1004.5~18.04.14.18.0-1005.6~18.04.14.18.0-1006.7~18.04.14.18.0-1007.8~18.04.1

Fixed in:

4.18.0-1008.9~18.04.1

Ubuntu:16.04:LTSlinux-hwe

Affected versions:

4.10.0-27.30~16.04.24.10.0-28.32~16.04.24.10.0-30.34~16.04.14.10.0-32.36~16.04.14.10.0-33.37~16.04.14.10.0-35.39~16.04.14.10.0-37.41~16.04.14.10.0-38.42~16.04.14.10.0-40.44~16.04.14.10.0-42.46~16.04.1+37 more

Fixed in:

4.15.0-47.50~16.04.1

Ubuntu:18.04:LTSlinux-hwe

Affected versions:

4.18.0-13.14~18.04.14.18.0-14.15~18.04.14.18.0-15.16~18.04.14.18.0-16.17~18.04.1

Fixed in:

4.18.0-17.18~18.04.1

Ubuntu:18.04:LTSlinux-hwe-edge

Fixed in:

5.0.0-15.16~18.04.1

Ubuntu:16.04:LTSlinux-kvm

Fixed in:

4.4.0-1004.9

Ubuntu:18.04:LTSlinux-kvm

Affected versions:

4.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1006.64.15.0-1008.84.15.0-1010.104.15.0-1011.114.15.0-1012.124.15.0-1016.164.15.0-1017.17+10 more

Fixed in:

4.15.0-1031.31

Ubuntu:14.04:LTSlinux-lts-xenial

Fixed in:

4.4.0-13.29~14.04.1

Ubuntu:18.04:LTSlinux-oem

Affected versions:

4.15.0-1002.34.15.0-1004.54.15.0-1006.94.15.0-1008.114.15.0-1009.124.15.0-1012.154.15.0-1013.164.15.0-1015.184.15.0-1017.204.15.0-1018.21+7 more

Fixed in:

4.15.0-1035.40

Ubuntu:16.04:LTSlinux-oracle

Affected versions:

4.15.0-1007.9~16.04.14.15.0-1008.10~16.04.14.15.0-1009.11~16.04.1

Fixed in:

4.15.0-1010.12~16.04.1

Ubuntu:18.04:LTSlinux-oracle

Affected versions:

4.15.0-1007.94.15.0-1008.104.15.0-1009.11

Fixed in:

4.15.0-1010.12

Ubuntu:16.04:LTSlinux-raspi2

Fixed in:

4.2.0-1013.19

Ubuntu:18.04:LTSlinux-raspi2

Affected versions:

4.13.0-1005.54.13.0-1006.64.13.0-1008.84.15.0-1006.74.15.0-1009.104.15.0-1010.114.15.0-1011.124.15.0-1012.134.15.0-1013.144.15.0-1017.18+12 more

Fixed in:

4.15.0-1033.35

Ubuntu:16.04:LTSlinux-snapdragon

Fixed in:

4.4.0-1012.12

Ubuntu:18.04:LTSlinux-snapdragon

Fixed in:

4.4.0-1077.82

References

REPORThttps://lore.kernel.org/lkml/20190219021038.11340-1-yuehaibing@huawei.com/REPORThttps://lore.kernel.org/lkml/20190219022512.GW2217@ZenIV.linux.org.uk/REPORThttps://ubuntu.com/security/CVE-2019-8980 REPORThttps://ubuntu.com/security/notices/USN-3930-1 REPORThttps://ubuntu.com/security/notices/USN-3930-2 REPORThttps://ubuntu.com/security/notices/USN-3931-1 REPORThttps://ubuntu.com/security/notices/USN-3931-2 REPORThttps://www.cve.org/CVERecord?id=CVE-2019-8980 REPORThttps://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1935698.html REPORThttps://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1935705.html

CVSS Analysis

CVSS v3.0

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Related

CVE-2019-8980 USN-3930-1 USN-3930-2 USN-3931-1 USN-3931-2

Ecosystems

Ubuntu 18.04 LTS Ubuntu 14.04 LTS Ubuntu 16.04 LTS

Timeline

PublishedFeb 21, 2019

ModifiedMay 26, 2025

UBUNTU-CVE-2019-8980 | Mondoo Vulnerability Intelligence