Resource Exhaustion Vulnerability in Linux Package: CVE-2019-20794
Summary
DEBIAN-CVE-2019-20794: An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources, hardware interactions, and process management. It is crucial for system stability and performance. This vulnerability affects versions of the Linux kernel from 4.18 to 5.6.11, particularly when unprivileged user namespaces are allowed, enabling users to create their own PID namespaces and mount FUSE filesystems.
Vulnerability Detail
CVE-2019-20794 is a vulnerability in the Linux kernel that allows unprivileged users to create their own PID namespaces and mount FUSE filesystems. If the userspace component of the FUSE filesystem is terminated by killing the PID namespace's PID 1, it can lead to a hung task, causing resources to be permanently locked until a system reboot occurs. This can result in resource exhaustion, severely impacting system performance and availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling unprivileged user namespaces if they are not required for your applications. This can be done by modifying the kernel parameters or using system configuration settings to restrict user namespace creation.
Conclusion
CVE-2019-20794 presents a significant risk to systems running affected versions of the Linux kernel, allowing unprivileged users to create PID namespaces that can lead to resource exhaustion. It is crucial to update to a patched version of the Linux kernel to mitigate this vulnerability and ensure system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2019-20794 is a vulnerability in the Linux kernel that allows unprivileged users to create PID namespaces and mount FUSE filesystems, leading to potential resource exhaustion.
The vulnerability affects Linux kernel versions from 4.18 to 5.6.11.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. You can also check your application against the vulnerability using the Vulert playground without needing to sign up.
Exploitation of this vulnerability can lead to resource exhaustion, causing system instability and requiring a reboot to recover locked resources.
Yes, the permanent fix is to update the Linux package to a version that is not affected by this vulnerability, specifically versions later than 5.6.11.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
