CVE-2019-0146 Denial of service in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers

What is CVE-2019-0146?

CVE-2019-0146 is a medium-severity denial of service vulnerability in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers, published on 14 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.

Weakness: CWE-772

Which versions are affected by CVE-2019-0146?

It affects 7 products.

Products include Intel Ethernet 700 Series Software, Intel Ethernet Controller 710-Bm1 Firmware, Intel Ethernet Controller X710-At2 Firmware, Intel Ethernet Controller X710-Bm2 Firmware, Intel Ethernet Controller X710-Tm4 Firmware, Intel Ethernet Controller Xxv710-Am1 Firmware and 1 more.

How do I fix CVE-2019-0146?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-0146 being exploited?

There is no known exploitation of CVE-2019-0146 in the wild and no public exploit code.

Other vulnerabilities in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers

• CVE-2019-0140 Memory corruption in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers High 8.8
• CVE-2019-0142 Privilege escalation in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers High 8.2
• CVE-2019-0145 Memory corruption in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers High 7.8
• CVE-2019-0139 Privilege escalation in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers Medium 6.7
• CVE-2019-0144 Denial of service in 2019.2 IPU – Intel(R) Ethernet 700 Series Controllers Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-0146, GHSA-r92v-6289-qqvf, UBUNTU-CVE-2019-0146.