{
  "threat_severity" : "Moderate",
  "public_date" : "2019-11-20T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: incomplete fix  for race condition between mmget_not_zero()/get_task_mm() and core dumping in CVE-2019-11599",
    "id" : "1774671",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1774671"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-821",
  "details" : [ "The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause a denial of service, or possibly have other unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls.", "The fix for CVE-2019-11599 was not complete. A local user could use this flaw to obtain sensitive information, cause a denial of service, or possibly have other unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls." ],
  "statement" : "The Red Hat Enterprise Linux 7  kernel versions prior to Red Hat Enterprise Linux 7.7 GA kernel (version 3.10.0-1062 released via RHSA-2019:2029) were never affected by CVE-2019-14898 (ie the incomplete fix for CVE-2019-1159) because they never backported the incomplete fix for CVE-2019-11599 in the first place; CVE-2019-11599 was fixed there fully, ie backport consisted of both CVE-2019-11599 and CVE-2019-14898 patches.",
  "acknowledgement" : "This issue was discovered by Vladis Dronov (Red Hat Engineering).",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2020-02-04T00:00:00Z",
    "advisory" : "RHSA-2020:0375",
    "cpe" : "cpe:/a:redhat:rhel_extras_rt:7",
    "package" : "kernel-rt-0:3.10.0-1062.12.1.rt56.1042.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2020-02-04T00:00:00Z",
    "advisory" : "RHSA-2020:0374",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "kernel-0:3.10.0-1062.12.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2020-02-04T00:00:00Z",
    "advisory" : "RHSA-2020:0328",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-147.5.1.rt24.98.el8_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2020-02-04T00:00:00Z",
    "advisory" : "RHSA-2020:0339",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-147.5.1.el8_1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-alt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise MRG 2",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/a:redhat:enterprise_mrg:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-14898\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-14898\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1790\nhttps://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.114\nhttps://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.37\nhttps://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.10" ],
  "name" : "CVE-2019-14898",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}