CVE-2019-20794 describes a resource exhaustion vulnerability in Linux kernel versions 4.18 through 5.6.11, specifically when unprivileged user namespaces are enabled. An attacker can trigger a hung task and resource lock-up, requiring a system reboot, by creating a PID namespace, mounting a FUSE filesystem, and then terminating the userspace component via a kill of the PID namespace's pid 1. This vulnerability has a CVSS score of 4.7 (Medium), indicating a local attack vector with high attack complexity and a high impact on availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.18, <= 5.6.11CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2019-20794
Sep 8, 2020An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. A user can create their own PID namespace and mount a FUSE filesystem. Upon interaction with this FUSE filesystem if the userspace component is terminated via a kill of the PID namespace's pid 1 it will result in a hung task and resources being permanently locked up until system reboot. This can result in resource exhaustion.
May 12, 2020kernel: task processes not being properly ended could lead to resource exhaustion
May 9, 2020