Vulnerability in Linux Kernel
CVE-2019-8956
In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory.
EPSS: 0.010 (77.6th percentile) — read the EPSS interpretation.
Affected products
- Unknown Linux Kernel — versions 4.20.x prior to 4.20.8, 4.19.x prior to 4.19.21
Public proof-of-concept exploits
References
- cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.21 (x_refsource_MISC)
- cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.8 (x_refsource_MISC)
- secuniaresearch.flexerasoftware.com/secunia_research/2019-5/ (x_refsource_MISC)
- git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/ (x_refsource_MISC)
- USN-3930-1 (vendor-advisory, x_refsource_UBUNTU)
- USN-3930-2 (vendor-advisory, x_refsource_UBUNTU)
- support.f5.com/csp/article/K12671141 (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2019-8956?
- CVE-2019-8956 is a vulnerability in Linux Kernel. Published 2019-04-01.
- Is CVE-2019-8956 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.