PT-2019-4232 · Linux+5 · Linux Kernel+5
Will Dormann
·
Published
2019-09-10
·
Updated
2021-06-14
·
CVE-2019-19073
CVSS v3.1
4.0
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.3.11
Description
The issue is related to memory leaks in the Linux kernel, specifically in the drivers/net/wireless/ath/ath9k/htc hst.c file. This can be exploited by attackers to cause a denial of service through memory consumption by triggering wait for completion timeout() failures. The functions affected include htc config pipe credits(), htc setup complete(), and htc connect service().
Recommendations
For Linux kernel versions prior to 5.3.11, update to a version 5.3.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected driver file to minimize the risk of exploitation.
Fix
DoS
Memory Leak
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu