CVE-2019-19947 — Use of Uninitialized Resource in Kernel

CWE-908 — Use of Uninitialized ResourceCWE-200 — Sensitive Information Exposure14 documents8 sources
Severity
4.6MEDIUMNVD
EPSS
0.1%
top 70.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Linux KernelNetapp E-series Santricity OS ControllerCanonical Ubuntu Linux+3 more
Timeline
PublishedDec 24
Latest updateMay 24

Description

In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 0.9 | Impact: 3.6

Affected Packages6 packages

▶Debianlinux/linux_kernel< 5.4.8-1+3
▶Ubuntulinux/linux_kernel< 4.4.0-186.216

Also affects: Debian Linux 8.0, Ubuntu Linux 14.04, 16.04, 18.04, 19.10

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-hvvf-8784-846m: In the Linux kernel through 5↗2022-05-24
▶
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities↗2020-09-03
▶
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities↗2020-07-27
▶
OSV
CVE-2019-19947: In the Linux kernel through 5↗2019-12-24
▶
CVEList
CVE-2019-19947: In the Linux kernel through 5↗2019-12-23
▶

📋Vendor Advisories

6
Ubuntu
Linux kernel vulnerabilities↗2020-09-03
▶
Ubuntu
Linux kernel vulnerabilities↗2020-07-27
▶
Ubuntu
Linux kernel vulnerabilities↗2020-02-19
▶
Ubuntu
Linux kernel vulnerabilities↗2020-02-18
▶
Red Hat
kernel: uninitialized memory allocation in drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c leading to information leak↗2020-01-06
▶

💬Community

2
Bugzilla
CVE-2019-19947 kernel: uninitialized memory allocation in drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c leading to information leak [fedora-all]↗2020-01-06
▶
Bugzilla
CVE-2019-19947 kernel: uninitialized memory allocation in drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c leading to information leak↗2020-01-06
▶
CVE-2019-19947 — Use of Uninitialized Resource | cvebase