PT-2019-4475 · Linux+3 · Linux Kernel+3

Published 2019-11-04 · Updated 2021-05-28 · CVE-2019-19529

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.3.11

Description The issue is related to a use-after-free bug in the Linux kernel, which can be triggered by a malicious USB device. This bug is associated with the drivers/net/can/usb/mcba usb.c driver. Exploitation of this bug can lead to a denial of service.

Recommendations For Linux kernel versions prior to 5.3.11, update to version 5.3.11 or later to resolve the issue. As a temporary workaround, consider restricting access to USB devices to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2019-3131

ALT-PU-2019-3155

ALT-PU-2019-3184

ALT-PU-2020-1198

ALT-PU-2020-1421

ALT-PU-2020-1450

ALT-PU-2020-1501

ALT-PU-2020-1714

ALT-PU-2020-2410

ALT-PU-2020-2433

ALT-PU-2021-1870

BDU:2020-00293

CVE-2019-19529

OPENSUSE-SU-2019:2675-1

OPENSUSE-SU-2019_2675-1

SUSE-SU-2019:3289-1

SUSE-SU-2019:3316-1

SUSE-SU-2019:3317-1

SUSE-SU-2019:3372-1

SUSE-SU-2019:3381-1

SUSE-SU-2019:3389-1

SUSE-SU-2020:0093-1

SUSE-SU-2020:0584-1

SUSE-SU-2020:0599-1

SUSE-SU-2020:0613-1

USN-4225-1

USN-4225-2

USN-4226-1

USN-4227-1

USN-4227-2

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 719

• https://ubuntu.com/security/CVE-2019-19052 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19044 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19072 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19529 · Vendor Advisory
• https://usn.ubuntu.com/4225-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2675-1 · Vendor Advisory
• https://usn.ubuntu.com/4227-2 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11 · Vendor Advisory
• https://usn.ubuntu.com/4226-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19529 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4225-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18660 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19529 · Security Note
• https://ubuntu.com/security/CVE-2019-19922 · Vendor Advisory