Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2019-19046: Linux Kernel Memory Leak in IPMI BMC Registration
CVE-2019-19046 · published 6 years ago
Summary
A memory leak exists in the Linux kernel's IPMI BMC registration. This could potentially cause a denial-of-service situation if an attacker can exploit it, although it's disputed whether this is realistic. Affected systems should be updated to a fixed version of the Linux kernel to mitigate this risk.
What to do
- Update canonical linux-azure to version 4.15.0-1074.79~14.04.1.
- Update canonical linux-aws-hwe to version 4.15.0-1063.67~16.04.1.
- Update canonical linux-azure to version 4.15.0-1075.80.
- Update canonical linux-gcp to version 4.15.0-1058.62.
- Update canonical linux-hwe to version 4.15.0-91.92~16.04.1.
- Update canonical linux-oracle to version 4.15.0-1035.38~16.04.1.
- Update canonical linux to version 4.15.0-91.92.
- Update canonical linux-aws to version 4.15.0-1063.67.
- Update canonical linux-azure to version 5.0.0-1036.38.
- Update canonical linux-azure-5.3 to version 5.3.0-1019.20~18.04.1.
- Update canonical linux-gcp to version 5.0.0-1034.35.
- Update canonical linux-gcp-5.3 to version 5.3.0-1017.18~18.04.1.
- Update canonical linux-gke-4.15 to version 4.15.0-1055.58.
- Update canonical linux-gke-5.0 to version 5.0.0-1033.34.
- Update canonical linux-gke-5.3 to version 5.3.0-1017.18~18.04.1.
- Update canonical linux-hwe to version 5.3.0-46.38~18.04.1.
- Update canonical linux-kvm to version 4.15.0-1056.57.
- Update canonical linux-oem to version 4.15.0-1076.86.
- Update canonical linux-oem-osp1 to version 5.0.0-1047.52.
- Update canonical linux-oracle to version 4.15.0-1035.39.
- Update canonical linux-oracle-5.0 to version 5.0.0-1014.19.
- Update canonical linux-oracle-5.3 to version 5.3.0-1014.15~18.04.1.
- Update canonical linux-raspi2 to version 4.15.0-1057.61.
- Update canonical linux-raspi2-5.3 to version 5.3.0-1022.24~18.04.1.
- Update canonical linux-snapdragon to version 4.15.0-1074.81.
- Update canonical linux-aws-fips to version 4.15.0-2018.18.
- Update canonical linux-azure-fips to version 4.15.0-2006.7.
- Update debian linux to version 5.4.19-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-azure |
< 4.15.0-1074.79~14.04.1 Fix: upgrade to 4.15.0-1074.79~14.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-aws-hwe |
< 4.15.0-1063.67~16.04.1 Fix: upgrade to 4.15.0-1063.67~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-azure |
< 4.15.0-1075.80 Fix: upgrade to 4.15.0-1075.80
|
| Ubuntu:16.04:LTS | canonical | linux-gcp |
< 4.15.0-1058.62 Fix: upgrade to 4.15.0-1058.62
|
| Ubuntu:16.04:LTS | canonical | linux-hwe |
< 4.15.0-91.92~16.04.1 Fix: upgrade to 4.15.0-91.92~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-oracle |
< 4.15.0-1035.38~16.04.1 Fix: upgrade to 4.15.0-1035.38~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux |
< 4.15.0-91.92 Fix: upgrade to 4.15.0-91.92
|
| Ubuntu:18.04:LTS | canonical | linux-aws |
< 4.15.0-1063.67 Fix: upgrade to 4.15.0-1063.67
|
| Ubuntu:18.04:LTS | canonical | linux-azure |
< 5.0.0-1036.38 Fix: upgrade to 5.0.0-1036.38
|
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 |
< 5.3.0-1019.20~18.04.1 Fix: upgrade to 5.3.0-1019.20~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gcp |
< 5.0.0-1034.35 Fix: upgrade to 5.0.0-1034.35
|
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 |
< 5.3.0-1017.18~18.04.1 Fix: upgrade to 5.3.0-1017.18~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 |
< 4.15.0-1055.58 Fix: upgrade to 4.15.0-1055.58
|
| Ubuntu:18.04:LTS | canonical | linux-gke-5.0 |
< 5.0.0-1033.34 Fix: upgrade to 5.0.0-1033.34
|
| Ubuntu:18.04:LTS | canonical | linux-gke-5.3 |
< 5.3.0-1017.18~18.04.1 Fix: upgrade to 5.3.0-1017.18~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-hwe |
< 5.3.0-46.38~18.04.1 Fix: upgrade to 5.3.0-46.38~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-kvm |
< 4.15.0-1056.57 Fix: upgrade to 4.15.0-1056.57
|
| Ubuntu:18.04:LTS | canonical | linux-oem |
< 4.15.0-1076.86 Fix: upgrade to 4.15.0-1076.86
|
| Ubuntu:18.04:LTS | canonical | linux-oem-osp1 |
< 5.0.0-1047.52 Fix: upgrade to 5.0.0-1047.52
|
| Ubuntu:18.04:LTS | canonical | linux-oracle |
< 4.15.0-1035.39 Fix: upgrade to 4.15.0-1035.39
|
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 |
< 5.0.0-1014.19 Fix: upgrade to 5.0.0-1014.19
|
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 |
< 5.3.0-1014.15~18.04.1 Fix: upgrade to 5.3.0-1014.15~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-raspi2 |
< 4.15.0-1057.61 Fix: upgrade to 4.15.0-1057.61
|
| Ubuntu:18.04:LTS | canonical | linux-raspi2-5.3 |
< 5.3.0-1022.24~18.04.1 Fix: upgrade to 5.3.0-1022.24~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-snapdragon |
< 4.15.0-1074.81 Fix: upgrade to 4.15.0-1074.81
|
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-aws-fips |
< 4.15.0-2018.18 Fix: upgrade to 4.15.0-2018.18
|
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-azure-fips |
< 4.15.0-2006.7 Fix: upgrade to 4.15.0-2006.7
|
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield | All versions |
| Debian:12 | debian | linux |
< 5.4.19-1 Fix: upgrade to 5.4.19-1
|
| – | linux | linux_kernel |
<= 5.3.11 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
30 31 cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* |
| – | opensuse | leap |
15.1 cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
Original advisory text
A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by t...
A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control this failure at probe time
References
- https://ubuntu.com/security/CVE-2019-19046 Third Party Advisory
- https://ubuntu.com/security/notices/USN-4302-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4319-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4325-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-19046 Third Party Advisory
- https://github.com/torvalds/linux/commit/4aa7afb0ee20a97fbf0c5bab3df028d5fb85fda... Patch Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2019-19046 Vendor Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1157304 Issue Tracking
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://usn.ubuntu.com/4302-1/
- https://usn.ubuntu.com/4319-1/
- https://usn.ubuntu.com/4325-1/
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-401Memory Leak
Timeline
Published18 Nov 2019
Updated31 Oct 2026
First seen17 Aug 2026
Track software like this
Free during beta