Skip to content
Fencer Intel
high 8.8

CVE-2019-14378 in the critical feed json

ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the fir…

published 7y ago modified 4mo ago also EUVD-2019-5587

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
16.7%
EPSS 16.7% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.

Patch / fix

  • qemu Debian 14, Debian 13, Debian 12 1:4.1-1
  • slirp4netns Debian 14, Debian 13, Debian 12 0.3.2-1

debian advisories DEBIAN-CVE-2019-14378

  • qemu Ubuntu 16.04 LTS 1:2.5+dfsg-5ubuntu10.42
  • qemu Ubuntu 18.04 LTS 1:2.11+dfsg-1ubuntu7.20
  • qemu Ubuntu 20.04 LTS 1:4.2-1ubuntu1
  • qemu Ubuntu Pro 14.04 LTS 2.0.0+dfsg-2ubuntu1.47

ubuntu advisories UBUNTU-CVE-2019-14378

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • runc RHEL 8 1.0.0-55.rc5.dev.git2abd837.module+el8.1.0+3468+011f0ab0
  • podman RHEL 8 1.0.0-3.git921f98f.module+el8.1.0+4241+a7060183
  • skopeo RHEL 8 1:0.1.32-5.git1715c90.module+el8.1.0+4241+a7060183
  • buildah RHEL 8 1.5-5.gite94b4f9.module+el8.1.0+4241+a7060183
  • oci-umount RHEL 8 2:2.3.4-2.git87f9237.module+el8.1.0+3468+011f0ab0
  • slirp4netns RHEL 8 0.1-3.dev.gitc4e1bc5.module+el8.1.0+4308+9d868e48
  • podman-docker RHEL 8 1.0.0-3.git921f98f.module+el8.1.0+4241+a7060183
  • fuse-overlayfs RHEL 8 0.3-5.module+el8.1.0+3468+011f0ab0

red hat advisories RHSA-2019:3494RHSA-2019:3403RHSA-2020:2342RHSA-2020:0775RHSA-2020:0889RHBA-2019:3723

  • qemu SLE Module for Server Applications 15 SP1, SLE Module for Basesystem 15 SP1 3.1.1.1-9.6.2
  • xen SLE Point of Sale 11 SP3 4.2.5_21-45.33.1
  • xen SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 4.7.6_06-43.54.2
  • xen SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 4.9.4_04-3.56.2
  • xen SLES for SAP 12 SP4, SLES 12 SP4, SLED 12 SP4 +1 more 4.11.2_02-2.14.2
  • qemu SLES for SAP 12 SP4, SLES 12 SP4, SLED 12 SP4 2.11.2-5.18.1
  • qemu SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 2.6.2-41.55.1
  • qemu SLE Module for Server Applications 15, SLE Module for Basesystem 15 2.11.2-9.28.3

suse advisories SUSE-SU-2020:0388-1SUSE-SU-2019:2955-1SUSE-SU-2019:14201-1SUSE-SU-2019:2783-1SUSE-SU-2019:14199-1SUSE-SU-2019:2769-1

  • qemu openSUSE Tumbleweed 6.1.0-32.1
  • qemu openSUSE Leap 15.1 3.1.1.1-lp151.7.6.1
  • qemu-linux-user openSUSE Leap 15.1 3.1.1.1-lp151.7.6.1
  • qemu openSUSE Leap 15.0 2.11.2-lp150.7.25.1
  • qemu openSUSE Leap 15.1 3.1.1-lp151.7.3.3
  • qemu-testsuite openSUSE Leap 15.1 3.1.1-lp151.7.3.3
  • qemu-linux-user openSUSE Leap 15.1 3.1.1-lp151.7.3.2

opensuse advisories openSUSE-SU-2024:11287-1openSUSE-SU-2019:2510-1openSUSE-SU-2019:2059-1openSUSE-SU-2019:2041-1

  • oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082
  • oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43
  • oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43
  • fuse-overlayfs AlmaLinux 8 0.3-5.module_el8.3.0+2044+12421f43
  • fuse-overlayfs AlmaLinux 8 0.3-5.module_el8.4.0+2496+12421f43
  • fuse-overlayfs AlmaLinux 8 0.3-5.module_el8.5.0+119+9a9ec082
  • oci-systemd-hook AlmaLinux 8 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
  • oci-systemd-hook AlmaLinux 8 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43

almalinux advisories ALSA-2019:3494ALSA-2019:3403

  • oci-umount Rocky Linux 8 2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f
  • fuse-overlayfs Rocky Linux 8 0.3-5.module+el8.5.0+681+c9a1951f
  • fuse-overlayfs Rocky Linux 8 0.3-5.module+el8.4.0+557+48ba8b2f
  • oci-systemd-hook Rocky Linux 8 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f

rocky linux advisories RLSA-2019:3494RLSA-2019:3403

Is CVE-2019-14378 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-14378 updated cvss 7.0

QEMU: slirp: heap buffer overflow during packet reassembly

  • Red Hat Enterprise Linux 5 kvm
    affected: workaround, no fix planned “There is no external mitigation to prevent this out-of-bounds heap memory access.”
  • Red Hat Enterprise Linux 8 Advanced Virtualization qemu-img, qemu-kvm, qemu-kiwi, qemu-kvm-core, qemu-kvm-tests, qemu-kvm-common, +9 more
    affected: workaround, no fix available “There is no external mitigation to prevent this out-of-bounds heap memory access.”
  • Red Hat OpenStack Platform 9 (Mitaka) qemu-img-rhev, qemu-kvm-rhev, libcacard-rhev, qemu-kvm-tools-rhev, libcacard-devel-rhev, libcacard-tools-rhev, +1 more
    affected: workaround, no fix planned “There is no external mitigation to prevent this out-of-bounds heap memory access.”
  • Red Hat Advanced Virtualization CodeReady Builder for RHEL 8.1.0 hivex 1.3.15-7.module+el8.1.0+3554+1a3a94a6, netcf 0.2.8-12.module+el8.1.0+3921+a49f7d7b, libvirt 5.6.0-6.module+el8.1.0+4244+9aa4e6bb, seabios 1.12.0-5.module+el8.1.0+4022+29a53beb, libiscsi 1.18.0-8.module+el8.1.0+3554+1a3a94a6, libvirt-nss 5.6.0-6.module+el8.1.0+4244+9aa4e6bb, +41 more Red Hat Advanced Virtualization for RHEL 8.1.0 hivex 1.3.15-7.module+el8.1.0+3554+1a3a94a6, netcf 0.2.8-12.module+el8.1.0+3921+a49f7d7b, libvirt 5.6.0-6.module+el8.1.0+4244+9aa4e6bb, nbdkit 1.12.5-1.module+el8.1.0+3868+35f94834, seabios 1.12.0-5.module+el8.1.0+4022+29a53beb, libiscsi 1.18.0-8.module+el8.1.0+3554+1a3a94a6, +92 more
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHBA-2019:3723
  • Red Hat CodeReady Linux Builder (v. 8) hivex 1.3.15-7.module+el8.0.0+4084+cceb9f44, netcf 0.2.8-11.module+el8.0.0+4084+cceb9f44, seabios 1.11.1-4.module+el8.0.0+4084+cceb9f44, libiscsi 1.18.0-7.module+el8.0.0+4084+cceb9f44, libssh2 1.8.0-8.module+el8.0.0+4084+cceb9f44.1, libvirt 4.5.0-24.3.module+el8.0.0+4084+cceb9f44, +36 more
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHBA-2019:2715
  • Red Hat Enterprise Linux 7 Extras slirp4netns 0.3.0-8.el7_7
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:0889
  • Red Hat Enterprise Linux AppStream (v. 8) hivex 1.3.15-7.module+el8.0.0+4084+cceb9f44, nbdkit 1.4.2-5.module+el8.0.0+4084+cceb9f44, netcf 0.2.8-11.module+el8.0.0+4084+cceb9f44, podman 1.4.2-5.module+el8.1.0+4240+893c1ab8, buildah 1.9.0-5.module+el8.1.0+4240+893c1ab8, skopeo 0.1.37-5.module+el8.1.0+4240+893c1ab8, +114 more
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHBA-2019:2715
  • Red Hat Enterprise Linux Client (v. 7) qemu-img 1.5.3-167.el7_7.4, qemu-kvm 1.5.3-167.el7_7.4, qemu-kvm-tools 1.5.3-167.el7_7.4, qemu-kvm-common 1.5.3-167.el7_7.4 Red Hat Enterprise Linux ComputeNode Optional (v. 7) qemu-img 1.5.3-167.el7_7.4, qemu-kvm 1.5.3-167.el7_7.4, qemu-kvm-tools 1.5.3-167.el7_7.4, qemu-kvm-common 1.5.3-167.el7_7.4
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:0366
show 16 more
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) qemu-img 1.5.3-160.el7_6.6, qemu-kvm 1.5.3-160.el7_6.6, qemu-kvm-tools 1.5.3-160.el7_6.6, qemu-kvm-common 1.5.3-160.el7_6.6
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:2126
  • Red Hat Enterprise Linux Desktop (v. 6) qemu-img 0.12.1.2-2.506.el6_10.6, qemu-kvm 0.12.1.2-2.506.el6_10.6, qemu-kvm-tools 0.12.1.2-2.506.el6_10.6, qemu-guest-agent 0.12.1.2-2.506.el6_10.6
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:0775
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) qemu-img-ma 2.12.0-18.el7_6.6, qemu-kvm-ma 2.12.0-18.el7_6.6, qemu-kvm-tools-ma 2.12.0-18.el7_6.6, qemu-kvm-common-ma 2.12.0-18.el7_6.6
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:2065
  • Red Hat Enterprise Linux HPC Node (v. 6) qemu-img 0.12.1.2-2.506.el6_10.6, qemu-kvm 0.12.1.2-2.506.el6_10.6, qemu-kvm-tools 0.12.1.2-2.506.el6_10.6, qemu-guest-agent 0.12.1.2-2.506.el6_10.6 Red Hat Enterprise Linux Server (v. 6) qemu-img 0.12.1.2-2.506.el6_10.6, qemu-kvm 0.12.1.2-2.506.el6_10.6, qemu-kvm-tools 0.12.1.2-2.506.el6_10.6, qemu-guest-agent 0.12.1.2-2.506.el6_10.6
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:0775
  • Red Hat Enterprise Linux Server (v. 7) qemu-img 1.5.3-167.el7_7.4, qemu-kvm 1.5.3-167.el7_7.4, qemu-img-ma 2.12.0-33.el7_7.1, qemu-kvm-ma 2.12.0-33.el7_7.1, qemu-kvm-tools 1.5.3-167.el7_7.4, qemu-kvm-common 1.5.3-167.el7_7.4, +2 more
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:0366
  • Red Hat Enterprise Linux Server EUS (v. 7.6) qemu-img 1.5.3-160.el7_6.6, qemu-kvm 1.5.3-160.el7_6.6, qemu-img-ma 2.12.0-18.el7_6.6, qemu-kvm-ma 2.12.0-18.el7_6.6, qemu-kvm-tools 1.5.3-160.el7_6.6, qemu-kvm-common 1.5.3-160.el7_6.6, +2 more
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:2126
  • Red Hat Enterprise Linux Server Optional (v. 7) qemu-kvm-ma 2.12.0-33.el7_7.1, qemu-kvm-tools-ma 2.12.0-33.el7_7.1, qemu-kvm-common-ma 2.12.0-33.el7_7.1
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2019:3968
  • Red Hat Enterprise Linux Workstation (v. 6) qemu-img 0.12.1.2-2.506.el6_10.6, qemu-kvm 0.12.1.2-2.506.el6_10.6, qemu-kvm-tools 0.12.1.2-2.506.el6_10.6, qemu-guest-agent 0.12.1.2-2.506.el6_10.6
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:0775
  • Red Hat Enterprise Linux Workstation (v. 7) qemu-img 1.5.3-167.el7_7.4, qemu-kvm 1.5.3-167.el7_7.4, qemu-kvm-tools 1.5.3-167.el7_7.4, qemu-kvm-common 1.5.3-167.el7_7.4
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:0366
  • Red Hat OpenStack Platform 10.0 qemu-img-rhev 2.12.0-33.el7_7.4, qemu-kvm-rhev 2.12.0-33.el7_7.4, qemu-kvm-tools-rhev 2.12.0-33.el7_7.4, qemu-kvm-common-rhev 2.12.0-33.el7_7.4
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2019:4344
  • Red Hat OpenStack Platform 13.0 qemu-img-rhev 2.12.0-33.el7_7.4, qemu-kvm-rhev 2.12.0-33.el7_7.4, qemu-kvm-tools-rhev 2.12.0-33.el7_7.4, qemu-kvm-common-rhev 2.12.0-33.el7_7.4
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2019:3787
  • Red Hat OpenStack Platform 14.0 qemu-img-rhev 2.12.0-33.el7_7.4, qemu-kvm-rhev 2.12.0-33.el7_7.4, qemu-kvm-tools-rhev 2.12.0-33.el7_7.4, qemu-kvm-common-rhev 2.12.0-33.el7_7.4
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2019:3742
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts qemu-img-rhev 2.12.0-44.el7, qemu-kvm-rhev 2.12.0-44.el7, qemu-img-rhev 2.12.0-33.el7_7.4, qemu-kvm-rhev 2.12.0-33.el7_7.4, qemu-kvm-tools-rhev 2.12.0-44.el7, qemu-kvm-common-rhev 2.12.0-44.el7, +2 more
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2019:3179
  • Red Hat RHV-M 4.2 qemu-img-rhev 2.12.0-18.el7_6.11, qemu-kvm-rhev 2.12.0-18.el7_6.11, qemu-kvm-tools-rhev 2.12.0-18.el7_6.11, qemu-kvm-common-rhev 2.12.0-18.el7_6.11
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2020:2342
  • Red Hat RHV-M 4.3 qemu-img-rhev 2.12.0-44.el7, qemu-kvm-rhev 2.12.0-44.el7, qemu-img-rhev 2.12.0-33.el7_7.4, qemu-kvm-rhev 2.12.0-33.el7_7.4, qemu-kvm-tools-rhev 2.12.0-44.el7, qemu-kvm-common-rhev 2.12.0-44.el7, +2 more
    fixed: vendor fix “There is no external mitigation to prevent this out-of-bounds heap memory access.” RHSA-2019:3179
  • Red Hat Enterprise Linux 5 xen Red Hat OpenShift Container Platform 4 slirp4netns
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-47320)

Exploit prediction

16.66% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-755 Improper Handling of Exceptional Conditions
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.