« Back to list

CVE-2019-18567

Status: ModifiedMedium (6.3)—

Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing Kernel memory leaks or denial of service.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

HP — Bromium

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2019-18567",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.3,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cert@airbus.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.8
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "cert@airbus.com",
      "affectedData": [
        {
          "vendor": "Bromium",
          "product": "Bromium client",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.3.2060"
            },
            {
              "status": "affected",
              "version": "?< 4.0.3.2060"
            },
            {
              "status": "affected",
              "version": "?>= 4.0.3.2060"
            },
            {
              "status": "affected",
              "version": "< 4.1.7 Update 1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-03T18:15:11.943",
  "references": [
    {
      "url": "https://airbus-cyber-security.com/dive-into-a-kernel-bromium-race-condition-cve-2019-18567",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cert@airbus.com"
    },
    {
      "url": "https://support.bromium.com/s/article/Bromium-Secure-Platform-4-1-Update-7-Released",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cert@airbus.com"
    },
    {
      "url": "https://airbus-cyber-security.com/dive-into-a-kernel-bromium-race-condition-cve-2019-18567",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.bromium.com/s/article/Bromium-Secure-Platform-4-1-Update-7-Released",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cert@airbus.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing Kernel memory leaks or denial of service."
    },
    {
      "lang": "es",
      "value": "El cliente Bromium versión 4.0.3.2060 y anterior a 4.1.7 Update 1, presenta un resultado de lectura fuera de límite en condición de carrera causando perdidas de memoria del Kernel o una denegación de servicio."
    }
  ],
  "lastModified": "2026-06-17T02:25:06.483",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hp:bromium:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9455F1E6-779F-40C0-B4B9-326E61AFE3A3",
              "versionEndIncluding": "4.1.7",
              "versionStartIncluding": "4.0.3.2060"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cert@airbus.com"
}