Vulnerability Database

289,784

Total vulnerabilities in the database

CVE-2019-18805

An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.

  • Published: Nov 7, 2019
  • Updated: Apr 13, 2023
  • CVE: CVE-2019-18805
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.8
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
linux / linux_kernel 5.1-rc2 5.1-rc2.x
linux / linux_kernel 5.1-rc3 5.1-rc3.x
linux / linux_kernel 5.1-rc4 5.1-rc4.x
linux / linux_kernel 5.1-rc5 5.1-rc5.x
linux / linux_kernel 5.1-rc1 5.1-rc1.x
linux / linux_kernel 5.1-rc6 5.1-rc6.x
linux / linux_kernel 4.9 4.9.172
linux / linux_kernel 4.4 4.4.180
linux / linux_kernel 4.14 4.14.115
linux / linux_kernel 4.19 4.19.38
linux / linux_kernel 5.0 5.0.11
linux / linux_kernel 5.1-rc7 5.1-rc7.x
opensuse / leap 15.0 15.0.x
opensuse / leap 15.1 15.1.x
redhat / enterprise_linux 7.0 7.0.x
netapp / e-series_santricity_os_controller 11.0.0 11.60.3.x