CVE-2019-11815 is a use-after-free race condition vulnerability in the Linux kernel's RDS over TCP implementation (net/rds/tcp.c), affecting versions prior to 5.0.8. This flaw, related to network namespace cleanup, impacts various distributions including Canonical, Debian, and openSUSE. With a CVSS score of 8.1 (HIGH), this vulnerability is remotely exploitable with high impact on confidentiality, integrity, and availability, though it requires high attack complexity. The EPSS score is low, suggesting a low probability of exploitation in the wild. Currently, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB, and it is not listed in CISA's KEV catalog. Despite this, the vulnerability has garnered significant community discussion and media coverage, with some reports suggesting potential for remote code execution or privilege escalation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.3, < 4.4.179CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.9, < 4.9.169CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.14, < 4.14.112CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.19, < 4.19.35CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.0, < 5.0.8CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.