CVE-2019-20423

Description

In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validation for specific fields of packets sent by a client. The function target_handle_connect() mishandles a certain size value when a client connects to a server, because of an integer signedness error.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
linux-aws	19.10 eoan	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Ignored was needs-triage ESM criteria
linux-aws-5.0	19.10 eoan	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-gke-5.3	19.10 eoan	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-oem-5.4	19.10 eoan	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-oracle-5.0	19.10 eoan	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux	19.10 eoan	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Ignored was needs-triage ESM criteria
linux-aws-hwe	19.10 eoan	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-azure	19.10 eoan	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Ignored was needs-triage ESM criteria
linux-azure-5.3	19.10 eoan	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-azure-edge	19.10 eoan	Not in release
	18.04 LTS bionic	Ignored end of life, was needs-triage
	16.04 LTS xenial	Ignored end of standard support, was needs-triage
	14.04 LTS trusty	Not in release
linux-gcp	19.10 eoan	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-gcp-5.3	19.10 eoan	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-gcp-edge	19.10 eoan	Not in release
	18.04 LTS bionic	Ignored end of life, was needs-triage
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-gke-4.15	19.10 eoan	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-gke-5.0	19.10 eoan	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-hwe	19.10 eoan	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-hwe-edge	19.10 eoan	Not in release
	18.04 LTS bionic	Ignored end of life, was needs-triage
	16.04 LTS xenial	Ignored end of life, was needs-triage
	14.04 LTS trusty	Not in release
linux-kvm	19.10 eoan	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-lts-trusty	19.10 eoan	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-xenial	19.10 eoan	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Ignored was needs-triage ESM criteria
linux-oem	19.10 eoan	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Ignored end of standard support, was needs-triage
	14.04 LTS trusty	Not in release
linux-oem-osp1	19.10 eoan	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-oracle	19.10 eoan	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-raspi2	19.10 eoan	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-raspi2-5.3	19.10 eoan	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-snapdragon	19.10 eoan	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release

Notes

sbeattie

lustre was removed from the upstream staging tree in 4.18 (be65f9ed267fd7d8b3146b7c4be9ecdd3e0aa3ed)

cascardo

The affected code was never part of linux, as the staging driver was only the client side.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
linux	Introduced by d7e09d0, fixed by -

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H