How severe is CVE-2019-3901?

CVE-2019-3901 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2019-3901 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-3901?

CVE-2019-3901 primarily affects Netapp Active Iq Unified Manager For Vmware Vsphere. In total, 10 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-3901?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2019-3901 published?

CVE-2019-3901 was published on 2019-04-22 and last updated on 2026-06-17.

CVE-2019-3901

CVE-2019-3901 is a medium-severity vulnerability in Netapp Active Iq Unified Manager For Vmware Vsphere with a CVSS 3.x base score of 4.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-667.

Key facts

Severity: Medium (CVSS 3.x base score 4.7)
CVSS v2: 1.9
EPSS exploit prediction: 0% (26th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-667
Affected product: Netapp Active Iq Unified Manager For Vmware Vsphere
Published: 2019-04-22
Last modified: 2026-06-17

Description

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8.

Frequently asked questions

What is CVE-2019-3901?: A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8.
How severe is CVE-2019-3901?: CVE-2019-3901 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2019-3901 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-3901?: CVE-2019-3901 primarily affects Netapp Active Iq Unified Manager For Vmware Vsphere. In total, 10 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-3901?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2019-3901 published?: CVE-2019-3901 was published on 2019-04-22 and last updated on 2026-06-17.

References

Affected products (10)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager_for_vmware_vsphere:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap_for_vmware_vsphere:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:virtual_storage_console_for_vmware_vsphere:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Netapp Active Iq Unified Manager For Vmware Vsphere

CVE-2019-3846 — High (CVSS 8.8): A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel…
CVE-2019-3900 — High (CVSS 7.7): An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while…
CVE-2019-3874 — Medium (CVSS 6.5): The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use…
CVE-2019-3882 — Medium (CVSS 5.5): A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory…

All CVEs affecting Netapp Active Iq Unified Manager For Vmware Vsphere →

Other CWE-667 (Improper Locking) vulnerabilities

CVE-2020-12658 — Critical (CVSS 9.8): gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in…
CVE-2019-5886 — Critical (CVSS 9.8): An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation…
CVE-2026-43215 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used…
CVE-2026-31629 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED…
CVE-2020-15674 — High (CVSS 8.8): Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory…
CVE-2021-1622 — High (CVSS 8.6): A vulnerability in the Common Open Policy Service (COPS) of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband…

Browse all CWE-667 (Improper Locking) vulnerabilities →