CVE-2019-18805 Integer overflow in n/a
A signed integer overflow in the Linux kernel TCP implementation allows local users to cause a denial of service by writing a large value to a specific proc file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-18805?
CVE-2019-18805 is a critical vulnerability in Broadcom Fabric Operating System, published on 7 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.
Weakness: CWE-190
Which versions are affected by CVE-2019-18805?
It affects 17 products.
Products include Broadcom Fabric Operating System, Linux kernel, Netapp Active Iq Unified Manager, Netapp Aff A400 Firmware, Netapp Aff A700s Firmware, Netapp Data Availability Services and 11 more.
How do I fix CVE-2019-18805?
Upgrade to a fixed version.
Is CVE-2019-18805 being exploited?
There is no known exploitation of CVE-2019-18805 in the wild and no public exploit code.
Other vulnerabilities in Broadcom Fabric Operating System
Sources
Also known as DEBIAN-CVE-2019-18805, GHSA-wgj3-wxrf-qqg3, UBUNTU-CVE-2019-18805.