VULNERABILITY INTELLIGENCE

CVE-2019-8956

CVSS score7.8 HIGH

EPSS probability1.13%

CISA KEVNot currently listed

Published2019-04-01

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory.

Weakness classification

CWE-416: Use After Free
CWE-787: Out-of-bounds Write

Primary references

PSIRT-CNA@flexerasoftware.com — Release Notes, Vendor Advisory
PSIRT-CNA@flexerasoftware.com — Release Notes, Vendor Advisory
PSIRT-CNA@flexerasoftware.com — Mailing List, Patch, Vendor Advisory
PSIRT-CNA@flexerasoftware.com — Broken Link
PSIRT-CNA@flexerasoftware.com — Third Party Advisory
PSIRT-CNA@flexerasoftware.com — Third Party Advisory
PSIRT-CNA@flexerasoftware.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory