CVE-2019-7221 json
The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
published 2019-03-17 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-16765
- cvss
- 7.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
Patch / fix
- linux Debian 14, Debian 13, Debian 12 4.19.20-1
debian advisories DEBIAN-CVE-2019-7221
- linux Ubuntu 16.04 LTS 4.4.0-145.171
- linux Ubuntu 18.04 LTS 4.15.0-47.50
- linux-aws Ubuntu 14.04 LTS 4.4.0-1040.43
- linux-aws Ubuntu 16.04 LTS 4.4.0-1079.89
- linux-aws Ubuntu 18.04 LTS 4.15.0-1035.37
- linux-gcp Ubuntu 16.04 LTS 4.15.0-1029.31~16.04.1
- linux-gcp Ubuntu 18.04 LTS 4.15.0-1029.31
- linux-hwe Ubuntu 16.04 LTS 4.15.0-47.50~16.04.1
ubuntu advisories UBUNTU-CVE-2019-7221
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel RHEL 7 3.10.0-957.12.1.el7
- perf RHEL 7 3.10.0-957.12.1.el7
- bpftool RHEL 7 3.10.0-957.12.1.el7
- python-perf RHEL 7 3.10.0-957.12.1.el7
- kernel-kdump RHEL 7 3.10.0-957.12.1.el7
- kernel-tools RHEL 7 3.10.0-957.12.1.el7
- kernel-tools-libs RHEL 7 3.10.0-957.12.1.el7
- kernel-bootwrapper RHEL 7 3.10.0-957.12.1.el7
red hat advisories RHSA-2019:3967RHSA-2019:4058RHSA-2019:0818RHSA-2019:0833
- kernel-ec2 SLE Module for Public Cloud 12 3.12.74-60.64.110.1
- kernel-azure SLES for SAP 12 SP3, SLES 12 SP3 4.4.176-4.25.1
- kernel-syms-azure SLES for SAP 12 SP3, SLES 12 SP3 4.4.176-4.25.1
- kernel-source-azure SLES for SAP 12 SP3, SLES 12 SP3 4.4.176-4.25.1
- kernel-syms SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 4.4.121-92.104.1
- kernel-source SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 4.4.121-92.104.1
- kernel-default SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +3 more 4.4.121-92.104.1
- kgraft-patch-SLE12-SP2_Update_28 SLES for SAP 12 SP2, SLES 12 SP2-LTSS, OpenStack Cloud 7 +1 more 1-3.3.1
suse advisories SUSE-SU-2019:1289-1SUSE-SU-2019:0901-1SUSE-SU-2019:0845-1SUSE-SU-2019:0828-1SUSE-SU-2019:0785-1SUSE-SU-2019:0784-1
- kernel-source openSUSE Tumbleweed 5.14.6-1.4
- kernel-source openSUSE Tumbleweed 6.6.17-1.1
- kernel-source openSUSE Leap 15.0 4.12.14-lp150.12.48.1
opensuse advisories openSUSE-SU-2024:10728-1openSUSE-SU-2024:13704-1openSUSE-SU-2019:0203-1
- linux Arch Linux 4.20.8.arch1-1
arch linux advisories AVG-850
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-7221 updated cvss 7.5
Kernel: KVM: nVMX: use-after-free of the hrtimer for emulation of the preemption timer
-
Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-957.12.1.el7, kernel 3.10.0-957.12.1.el7, bpftool 3.10.0-957.12.1.el7, python-perf 3.10.0-957.12.1.el7, kernel-tools 3.10.0-957.12.1.el7, kernel-tools-libs 3.10.0-957.12.1.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-957.12.1.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-957.12.1.el7, kernel 3.10.0-957.12.1.el7, bpftool 3.10.0-957.12.1.el7, python-perf 3.10.0-957.12.1.el7, kernel-tools 3.10.0-957.12.1.el7, kernel-tools-libs 3.10.0-957.12.1.el7, +2 morefixed: vendor fix RHSA-2019:0818
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) perf 3.10.0-862.44.2.el7, kernel 3.10.0-862.44.2.el7, python-perf 3.10.0-862.44.2.el7, kernel-tools 3.10.0-862.44.2.el7, kernel-tools-libs 3.10.0-862.44.2.el7, kernel-abi-whitelists 3.10.0-862.44.2.el7, +1 morefixed: vendor fix RHSA-2019:3967
-
Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-957.12.1.el7fixed: vendor fix RHSA-2019:0818
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) kernel-debuginfo-common-x86_64 3.10.0-862.44.2.el7fixed: vendor fix RHSA-2019:3967
-
Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-957.12.1.rt56.927.el7, kernel-rt-kvm 3.10.0-957.12.1.rt56.927.el7, kernel-rt-trace 3.10.0-957.12.1.rt56.927.el7, kernel-rt-debug-kvm 3.10.0-957.12.1.rt56.927.el7, kernel-rt-trace-kvm 3.10.0-957.12.1.rt56.927.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-957.12.1.rt56.927.el7 Red Hat Enterprise Linux Realtime (v. 7) kernel-rt 3.10.0-957.12.1.rt56.927.el7, kernel-rt-trace 3.10.0-957.12.1.rt56.927.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-957.12.1.rt56.927.el7fixed: vendor fix RHSA-2019:0833
-
Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-957.12.1.el7, kernel 3.10.0-957.12.1.el7, bpftool 3.10.0-957.12.1.el7, python-perf 3.10.0-957.12.1.el7, kernel-kdump 3.10.0-957.12.1.el7, kernel-tools 3.10.0-957.12.1.el7, +7 morefixed: vendor fix RHSA-2019:0818
-
Red Hat Enterprise Linux Server AUS (v. 7.4) perf 3.10.0-693.61.1.el7, kernel 3.10.0-693.61.1.el7, python-perf 3.10.0-693.61.1.el7, kernel-tools 3.10.0-693.61.1.el7, kernel-tools-libs 3.10.0-693.61.1.el7, kernel-abi-whitelists 3.10.0-693.61.1.el7, +1 more Red Hat Enterprise Linux Server E4S (v. 7.4) perf 3.10.0-693.61.1.el7, kernel 3.10.0-693.61.1.el7, python-perf 3.10.0-693.61.1.el7, kernel-tools 3.10.0-693.61.1.el7, kernel-tools-libs 3.10.0-693.61.1.el7, kernel-bootwrapper 3.10.0-693.61.1.el7, +3 morefixed: vendor fix RHSA-2019:4058
-
Red Hat Enterprise Linux Server EUS (v. 7.5) perf 3.10.0-862.44.2.el7, kernel 3.10.0-862.44.2.el7, python-perf 3.10.0-862.44.2.el7, kernel-kdump 3.10.0-862.44.2.el7, kernel-tools 3.10.0-862.44.2.el7, kernel-tools-libs 3.10.0-862.44.2.el7, +6 morefixed: vendor fix RHSA-2019:3967
show 6 moreshow fewer
-
Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-957.12.1.el7, kernel-debuginfo-common-x86_64 3.10.0-957.12.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-957.12.1.el7fixed: vendor fix RHSA-2019:0818
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.61.1.el7 Red Hat Enterprise Linux Server Optional E4S (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.61.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-693.61.1.el7fixed: vendor fix RHSA-2019:4058
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.5) kernel-debuginfo-common-ppc64 3.10.0-862.44.2.el7, kernel-debuginfo-common-x86_64 3.10.0-862.44.2.el7, kernel-debuginfo-common-ppc64le 3.10.0-862.44.2.el7fixed: vendor fix RHSA-2019:3967
-
Red Hat Enterprise Linux Server Optional TUS (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.61.1.el7 Red Hat Enterprise Linux Server TUS (v. 7.4) perf 3.10.0-693.61.1.el7, kernel 3.10.0-693.61.1.el7, python-perf 3.10.0-693.61.1.el7, kernel-tools 3.10.0-693.61.1.el7, kernel-tools-libs 3.10.0-693.61.1.el7, kernel-abi-whitelists 3.10.0-693.61.1.el7, +1 morefixed: vendor fix RHSA-2019:4058
-
Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-957.12.1.el7, kernel 3.10.0-957.12.1.el7, bpftool 3.10.0-957.12.1.el7, python-perf 3.10.0-957.12.1.el7, kernel-tools 3.10.0-957.12.1.el7, kernel-tools-libs 3.10.0-957.12.1.el7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-957.12.1.el7fixed: vendor fix RHSA-2019:0818
-
Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, kernel-alt, python-perf, kernel-kdump, kernel-tools, +3 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmwarenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.80% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- bugs.chromium.org https://bugs.chromium.org/p/project-zero/issues/detail?id=1760 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-416 Use After Free
- Technology feeds
References
-
git.kernel.org
/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ecec76885bcfe3294685dc363fd1273df0d5d65f
mailing-list, patch, vendor-advisory
-
openwall.com
/lists/oss-security/2019/02/18/2
mailing-list, patch, third-party-advisory
-
bugs.chromium.org
/p/project-zero/issues/detail?id=1760
exploit, patch, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/KDOXCX3QFVWYXH5CQMGDDE7H6MUG5XGG/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/Y2HMABEMJDPA6LPCBE5WIEZXUKY7DLTN/
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-02/msg00042.html
vendor-advisory, mailing-list, third-party-advisory
-
usn.ubuntu.com
/3932-1/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3932-2/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3930-1/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3931-1/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3931-2/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3930-2/
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:0833
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:0818
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHBA-2019:0959
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:3967
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:4058
vendor-advisory
-
packetstormsecurity.com
/files/151713/KVM-VMX-Preemption-Timer-Use-After-Free.html
third-party-advisory, vdb-entry
-
github.com
/torvalds/linux/commits/master/arch/x86/kvm
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2019/03/msg00034.html
mailing-list, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2019/04/msg00004.html
mailing-list, third-party-advisory
-
security.netapp.com
/advisory/ntap-20190404-0002/
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2019/05/msg00002.html
mailing-list, third-party-advisory
- support.f5.com /csp/article/K08413011
Sources
- CVE List CVE-2019-7221
- NVD CVE-2019-7221
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.