WaratekVRT Sign in

CVE-2019-9162

Affected software3 products, listed below
Severity7.8 High CVSS 3.1 2 scores
WeaknessOut-of-bounds write (CWE-787)
Published25 Feb 2019
Updated17 Jun 2026

Description

In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2019-03-01.
  • EPSS 1.1% chance in 30 days
IndexArtifactStarsFirst seen
Exploit-DB Linux < 4.14.103 / < 4.19.25 - Out-of-Bounds Read and Write in SNMP NAT Module 2019-03-01

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.8 HIGH v3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 4.6 none AV:L/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Products and versions

6 products, 8 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 18.04 · 18.10
nvd linux linux kernel generic ≥ 4.19 and ＜ 4.19.25 · ≥ 4.20 and ＜ 4.20.12
nvd netapp cn1610 firmware generic any version
nvd netapp hci management node generic any version
nvd netapp snapprotect generic any version
nvd netapp solidfire generic any version

References

URLTags
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c4c07b4d6fa1f11880eab8e076d3d060ef3f55fc Mailing List, Patch, Vendor Advisory
http://www.securityfocus.com/bid/107159 Broken Link
https://bugs.chromium.org/p/project-zero/issues/detail?id=1776 Exploit, Issue Tracking, Mailing List, Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.25 Mailing List, Vendor Advisory
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.12 Mailing List, Vendor Advisory
https://github.com/torvalds/linux/commit/c4c07b4d6fa1f11880eab8e076d3d060ef3f55fc Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20190327-0002/ Third Party Advisory
https://support.f5.com/csp/article/K31864522 Third Party Advisory
https://usn.ubuntu.com/3930-1/ Third Party Advisory
https://usn.ubuntu.com/3930-2/ Third Party Advisory

Timeline
Published2019-02-25By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.