PT-2019-4229 · Linux+2 · Linux Kernel+2
Wolfgang Frisch
·
Published
2019-10-01
·
Updated
2025-05-05
·
CVE-2019-19064
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 5.3.11
Description
The issue is related to a memory leak in the
fsl lpspi probe() function in the Linux kernel, which can cause a denial of service due to memory consumption. This can be triggered by failures in pm runtime get sync(). However, it is noted that third parties dispute the relevance of this issue because an attacker cannot realistically control these failures at probe time.Recommendations
For Linux kernel versions through 5.3.11, consider updating to a version that fixes this issue. As a temporary workaround, restricting access to the
fsl lpspi probe() function may help minimize the risk of exploitation. However, since the control of pm runtime get sync() failures is not realistic for an attacker, the practical impact of this workaround may be limited. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Memory Leak
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linux Kernel
Ubuntu