{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2019-19339 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2019-19339 is a medium-severity denial of service vulnerability in Redhat Enterprise Linux, published on 17 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2019-19339 and fix it if it is affected.\n\nWhat it is: CVE-2019-19339 is a medium-severity denial of service vulnerability in Redhat Enterprise Linux, published on 17 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2019-19339 in the wild and no public exploit code.\n\nAffected product: Redhat Enterprise Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2019-19339/ (Markdown: https://insights.sbomify.com/CVE-2019-19339/index.md)","id":"CVE-2019-19339","markdown":"https://insights.sbomify.com/CVE-2019-19339/index.md","name":"CVE-2019-19339","record":{"aliases":["GHSA-3848-jq8g-9mvf","RHSA-2019:4245"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Red Hat Enterprise Linux","requires_auth":"low_privilege","summary":"A privileged guest user can cause a host processor halt via a Machine Check Error due to incomplete TLB invalidation fixes in Red Hat Enterprise Linux 8.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[{"product":"enterprise_linux","vendor":"redhat"},{"product":"enterprise_linux_eus","vendor":"redhat"}],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","version":"3.0"},"cwes":[{"id":"CWE-805","name":"Buffer Access with Incorrect Length Value"}],"description":"It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between, virtual to physical memory address translations in CPU's local cache and system software's Paging structure entries. A privileged guest user may use this flaw to induce a hardware Machine Check Error on the host processor, resulting in a severe DoS scenario by halting the processor. System software like OS OR Virtual Machine Monitor (VMM) use virtual memory system for storing program instructions and data in memory. Virtual Memory system uses Paging structures like Page Tables and Page Directories to manage system memory. The processor's Memory Management Unit (MMU) uses Paging structure entries to translate program's virtual memory addresses to physical memory addresses. The processor stores these address translations into its local cache buffer called - Translation Lookaside Buffer (TLB). TLB has two parts, one for instructions and other for data addresses. System software can modify its Paging structure entries to change address mappings OR certain attributes like page size etc. Upon such Paging structure alterations in memory, system software must invalidate the corresponding address translations in the processor's TLB cache. But before this TLB invalidation takes place, a privileged guest user may trigger an instruction fetch operation, which could use an already cached, but now invalid, virtual to physical address translation from Instruction TLB (ITLB). Thus accessing an invalid physical memory address and resulting in halting the processor due to the Machine Check Error (MCE) on Page Size Change.","ecosystems":["Red Hat:enterprise_linux:8::baseos"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Denial of service in kpatch:","id":"CVE-2019-19339","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"redhat:enterprise_linux","products":["redhat:enterprise_linux","redhat:enterprise_linux_eus"],"type":"denial_of_service","year":"2019"},"n_packages":3,"n_references":1,"next":{"headline":"Misconfiguration in Tower","id":"CVE-2019-19340"},"packages":[{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:1-4.el8"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-147","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-147","source":"RHSA-2019:4245"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:1-4.el8"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-147-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-147-debuginfo","source":"RHSA-2019:4245"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:1-4.el8"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-147-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-147-debugsource","source":"RHSA-2019:4245"}],"prev":{"headline":"Information disclosure in Linux Kernel","id":"CVE-2019-19338"},"products":["kpatch:"],"published":"2020-01-17","related":[{"cvss_score":9.8,"headline":"Red Hat JBoss RichFaces Framework Expression Language Injection","id":"CVE-2018-14667","kev_date_added":"2023-09-28","published":"2018-11-06"},{"cvss_score":9.8,"headline":"Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit","id":"CVE-2021-20325","kev_date_added":null,"published":"2022-02-18"},{"cvss_score":9.8,"headline":"Memory corruption in libwebp","id":"CVE-2018-25011","kev_date_added":null,"published":"2021-05-21"},{"cvss_score":9.8,"headline":"Other in libwebp","id":"CVE-2018-25014","kev_date_added":null,"published":"2021-05-21"},{"cvss_score":9.8,"headline":"Supply chain in redhat-upgrade-tool","id":"CVE-2014-3585","kev_date_added":null,"published":"2019-11-22"},{"cvss_score":9.3,"headline":"Squid: request/response smuggling in http/1.1 and icap","id":"CVE-2023-46846","kev_date_added":null,"published":"2023-11-03"},{"cvss_score":9.1,"headline":"Memory corruption in libwebp","id":"CVE-2018-25009","kev_date_added":null,"published":"2021-05-21"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-05","vendors":["Red Hat"]},"summary":"A privileged guest user can cause a host processor halt via a Machine Check Error due to incomplete TLB invalidation fixes in Red Hat Enterprise Linux 8.","url":"https://insights.sbomify.com/CVE-2019-19339/"}