CVE-2019-25160

netlabel: fix out-of-bounds memory accesses

State: Published
Severity: 9.1 Critical
Published: Feb 26, 2024
Updated: Aug 5, 2026
Reserved: Feb 26, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

netlabel: fix out-of-bounds memory accesses

There are two array out-of-bounds memory accesses, one in cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk(). Both errors are embarassingly simple, and the fixes are straightforward.

As a FYI for anyone backporting this patch to kernels prior to v4.8, you'll want to apply the netlbl_bitmap_walk() patch to cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before Linux v4.8.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 97bc3683c24999ee621d847c9348c75d2fe86272Affected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before c61d01faa5550e06794dcf86125ccd325bfad950Affected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before dc18101f95fa6e815f426316b8b9a5cee28a334eAffected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 1c973f9c7cc2b3caae93192fdc8ecb3f0b4ac000Affected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before fcfe700acdc1c72eab231300e82b962bac2b2b2cAffected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before e3713abc4248aa6bcc11173d754c418b02a62cbbAffected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before fbf9578919d6c91100ec63acf2cba641383f6c78Affected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 5578de4834fe0f2a34fedc7374be691443396d1fAffected
LinuxLinux	2.6.19Affected before 2.6.19Not affected 3.16.66 through 3.16.Not affected 3.18.137 through 3.18.Not affected 4.4.177 through 4.4.Not affected 4.9.163 through 4.9.Not affected 4.14.106 through 4.14.Not affected 4.19.28 through 4.19.Not affected 4.20.15 through 4.20.*Not affected 5.0 and laterNot affected

Product

Versions

LinuxLinux

446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 97bc3683c24999ee621d847c9348c75d2fe86272Affected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before c61d01faa5550e06794dcf86125ccd325bfad950Affected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before dc18101f95fa6e815f426316b8b9a5cee28a334eAffected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 1c973f9c7cc2b3caae93192fdc8ecb3f0b4ac000Affected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before fcfe700acdc1c72eab231300e82b962bac2b2b2cAffected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before e3713abc4248aa6bcc11173d754c418b02a62cbbAffected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before fbf9578919d6c91100ec63acf2cba641383f6c78Affected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 5578de4834fe0f2a34fedc7374be691443396d1fAffected

LinuxLinux

2.6.19Affected
before 2.6.19Not affected
3.16.66 through 3.16.*Not affected
3.18.137 through 3.18.*Not affected
4.4.177 through 4.4.*Not affected
4.9.163 through 4.9.*Not affected
4.14.106 through 4.14.*Not affected
4.19.28 through 4.19.*Not affected
4.20.15 through 4.20.*Not affected
5.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.