PT-2019-4467 · Linux+5 · Linux Kernel+5

Published 2019-08-21 · Updated 2021-05-28 · CVE-2019-19533

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.3.4

Description The issue is related to an info-leak bug in the Linux kernel, specifically in the drivers/media/usb/ttusb-dec/ttusb dec.c driver. This bug can be triggered by a malicious USB device. The vulnerability is also described as a resource not being released after its valid lifetime, which can allow an attacker to disclose protected information.

Recommendations For Linux kernel versions prior to 5.3.4, update to version 5.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to USB devices from untrusted sources to minimize the risk of exploitation.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

ALSA-2020:4431

ALT-PU-2019-2838

ALT-PU-2019-2845

ALT-PU-2019-2891

ALT-PU-2020-1198

ALT-PU-2020-1501

ALT-PU-2020-1714

ALT-PU-2020-2410

ALT-PU-2020-2433

ALT-PU-2021-1870

BDU:2020-00285

CESA-2020_4431

CESA-2020_4609

CVE-2019-19533

DLA-2068-1

DLA-2114-1

OPENSUSE-SU-2020:0336-1

OPENSUSE-SU-2020_0336-1

RHSA-2020:4431

RHSA-2020:4609

RHSA-2020_4431

RHSA-2020_4609

SUSE-SU-2019:3316-1

SUSE-SU-2019:3379-1

SUSE-SU-2019:3381-1

SUSE-SU-2019:3389-1

SUSE-SU-2020:0093-1

SUSE-SU-2020:0511-1

SUSE-SU-2020:0560-1

SUSE-SU-2020:0584-1

SUSE-SU-2020:0599-1

SUSE-SU-2020:0613-1

SUSE-SU-2020:1255-1

Affected Products

Alt Linux

Almalinux

Centos

Linux Kernel

Red Hat

Suse

References · 808

• https://linux.oracle.com/errata/ELSA-2020-5753.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00285 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:3379-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0584-1 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a10feaf8c464c3f9cfdd3a8a7ce17e1c0d498da1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4431.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3389-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19533 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-5755.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2114-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-5754.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3381-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3316-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0511-1 · Vendor Advisory