Description

An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.

INFO

Published Date :

Oct. 8, 2019, 12:15 a.m.

Last Modified :

Aug. 24, 2020, 5:37 p.m.

Remotely Exploitable :

No

Impact Score :

4.0

Exploitability Score :

2.0
Public PoC/Exploit Available at Github

CVE-2019-17351 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2019-17351 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
1 Xen xen

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

None

Updated: 10 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Jan. 5, 2024, 7:12 a.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2019-17351 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2019-17351 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CWE Remap by [email protected]

    Aug. 24, 2020

    Action Type Old Value New Value
    Changed CWE CWE-400 CWE-770
  • CVE Modified by [email protected]

    Mar. 12, 2020

    Action Type Old Value New Value
    Added Reference https://usn.ubuntu.com/4286-1/ [No Types Assigned]
  • CVE Modified by [email protected]

    Feb. 26, 2020

    Action Type Old Value New Value
    Added Reference https://usn.ubuntu.com/4286-2/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 31, 2019

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20191031-0005/ [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 26, 2019

    Action Type Old Value New Value
    Added Reference http://xenbits.xen.org/xsa/advisory-300.html [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 25, 2019

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2019/10/25/9 [No Types Assigned]
  • Initial Analysis by [email protected]

    Oct. 11, 2019

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:L/AC:L/Au:N/C:N/I:N/A:C)
    Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
    Changed Reference Type https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3 No Types Assigned https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3 Third Party Advisory
    Changed Reference Type https://github.com/torvalds/linux/commit/6ef36ab967c71690ebe7e5ef997a8be4da3bc844 No Types Assigned https://github.com/torvalds/linux/commit/6ef36ab967c71690ebe7e5ef997a8be4da3bc844 Patch, Third Party Advisory
    Changed Reference Type https://xenbits.xen.org/xsa/advisory-300.html No Types Assigned https://xenbits.xen.org/xsa/advisory-300.html Vendor Advisory
    Added CWE NIST CWE-400
    Added CPE Configuration OR *cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* versions up to (including) 4.12.1
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 5.2.3
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2019-17351 is associated with the following CWEs:

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.05 }} 0.01%

score

0.21278

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability