Skip to content
OpenAdvisories
Unscored CVE-2019-20426 EUVD-2019-10974GHSA-9fwv-5489-f4p3

In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific…

Published Jan 27, 2020 · Updated Aug 5, 2024 · Assigned by mitre

Package: linux Package: linux-aws Package: linux-aws-5.15 Package: linux-aws-5.4 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.8 Package: linux-aws-7.0 Package: linux-aws-fips Package: linux-azure Package: linux-azure-4.15 Package: linux-azure-5.15 Package: linux-azure-5.4 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.8 Package: linux-azure-7.0 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.15 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.8 Package: linux-azure-fde-7.0 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-4.15 Package: linux-gcp-5.15 Package: linux-gcp-5.4 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.8 Package: linux-gcp-7.0 Package: linux-gcp-edge Package: linux-gcp-fips Package: linux-gke Package: linux-gkeop Package: linux-hwe-5.15 Package: linux-hwe-5.4 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.8 Package: linux-hwe-7.0 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-ibm-5.4 Package: linux-ibm-6.8 Package: linux-intel Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-iot Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.8 Package: linux-lts-xenial Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.8 Package: linux-nvidia-7.0 Package: linux-nvidia-bos Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.8 Package: linux-oem-7.0 Package: linux-oracle Package: linux-oracle-5.15 Package: linux-oracle-5.4 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.8 Package: linux-oracle-7.0 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.15 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.8 Package: linux-riscv-7.0 Package: linux-vmware Package: linux-xilinx Package: linux-xilinx-zynqmp Ecosystem: Ubuntu

Description

In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. In the function ldlm_cancel_hpreq_check, there is no lock_count bounds check.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield No fix yet —
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield No fix yet —
Ubuntu 26.10 linux +8 No fix yet —
Ubuntu 26.04 LTS linux +14 No fix yet —
Ubuntu 25.10 linux +8 No fix yet —
Show 19 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux +53 No fix yet —
Ubuntu 22.04 LTS linux +29 No fix yet —
Ubuntu 20.04 LTS linux-gke +3 No fix yet —
Ubuntu 18.04 LTS linux-gcp-edge +2 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-realtime +3 No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-realtime +2 No fix yet —
Ubuntu Pro FIPS 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 20.04 LTS linux-ibm +15 No fix yet —
Ubuntu Pro 18.04 LTS linux-aws-5.4 +8 No fix yet —
Ubuntu Pro 14.04 LTS linux +3 No fix yet —

References