CVE-2019-19529 — Use After Free in Kernel

CWE-416 — Use After Free17 documents7 sources
Severity
6.3MEDIUMNVD
OSV9.8OSV8.8
EPSS
0.1%
top 82.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux KernelDebian LinuxCanonical Ubuntu Linux
Timeline
PublishedDec 3
Latest updateMay 24

Description

In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver, aka CID-4d6636498c41.

CVSS vector

CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 0.4 | Impact: 5.9

Affected Packages4 packages

▶NVDlinux/linux_kernel< 5.3.11
▶Debianlinux/linux_kernel< 5.3.15-1+3
▶Ubuntulinux/linux_kernel< 4.15.0-74.84
▶debiandebian/linux< linux 5.3.15-1 (bookworm)

Also affects: Ubuntu Linux 14.04, 16.04, 18.04, 19.04, 19.10

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

7
GHSA
GHSA-2pfw-56q4-cfv3: In the Linux kernel before 5↗2022-05-24
▶
OSV
linux-hwe vulnerabilities↗2020-01-18
▶
OSV
linux-azure vulnerabilities↗2020-01-07
▶
OSV
linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2 vulnerabilities↗2020-01-07
▶
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities↗2020-01-07
▶

📋Vendor Advisories

7
Ubuntu
Linux kernel (HWE) vulnerabilities↗2020-01-18
▶
Ubuntu
Linux kernel vulnerabilities↗2020-01-07
▶
Ubuntu
Linux kernel vulnerabilities↗2020-01-07
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2020-01-07
▶
Ubuntu
Linux kernel vulnerabilities↗2020-01-07
▶

💬Community

2
Bugzilla
CVE-2019-19529 kernel: use-after-free bug caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c↗2019-12-13
▶
Bugzilla
CVE-2019-19529 kernel: use-after-free bug caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c [fedora-all]↗2019-12-13
▶