CVE-2018-19824: Use After Free

Q: What is the severity of CVE-2018-19824?

CVE-2018-19824 has a medium severity rating due to potential memory corruption by local users.

Q: How do I fix CVE-2018-19824?

To mitigate CVE-2018-19824, update the kernel package to a version higher than 4.19.6 or apply the recommended patches provided by your Linux distribution.

Q: Which Linux versions are affected by CVE-2018-19824?

CVE-2018-19824 affects Linux kernel versions up to and including 4.19.6.

Q: Can CVE-2018-19824 be exploited remotely?

No, CVE-2018-19824 requires local access to exploit the vulnerability through a malicious USB sound device.

Q: What kind of systems are vulnerable to CVE-2018-19824?

Systems running vulnerable versions of the Linux kernel, including Red Hat, Debian, and Ubuntu distributions, are susceptible to CVE-2018-19824.

Published Dec 3, 2018

Updated

A flaw was found In the Linux kernel, through version 4.19.6, where a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usbaudioprobe in sound/usb/card.c. An attacker could corrupt memory and possibly escalate privileges if the attacker is able to have physical access to the system.

Other sources

In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usbaudioprobe in sound/usb/card.c.

— Ubuntu

Affected Software

12 affected componentsFixes available

redhat/kernel<0:3.10.0-1062.el7

0:3.10.0-1062.el7

redhat/kernel-rt<0:4.18.0-80.11.1.rt9.156.el8_0

0:4.18.0-80.11.1.rt9.156.el8_0

redhat/kernel<0:4.18.0-80.11.1.el8_0

0:4.18.0-80.11.1.el8_0

Linux Linux kernel<=4.19.6

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=18.10

Debian Debian Linux=8.0

Google Android

debian/linux

6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:3.10.0-1062.el7
Upgrade
Upgrade redhat/kernel-rt to a version that resolves this vulnerability.
Fixed in 0:4.18.0-80.11.1.rt9.156.el8_0
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:4.18.0-80.11.1.el8_0
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 5f8cf712582617d523120df67d392059eaf2fc4b

Event History

Dec 3, 2018

CVE Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

RemedyDescriptionSeverityAffected Software

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

via NVD·05:29 PM

RemedyDescriptionSeverityWeaknessAffected Software

Dec 4, 2018

Data Sourced

via Red Hat·02:01 AM

DescriptionSeverityAffected Software

Oct 7, 2019

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2018-19824?

CVE-2018-19824 has a medium severity rating due to potential memory corruption by local users.

How do I fix CVE-2018-19824?

To mitigate CVE-2018-19824, update the kernel package to a version higher than 4.19.6 or apply the recommended patches provided by your Linux distribution.

Which Linux versions are affected by CVE-2018-19824?

CVE-2018-19824 affects Linux kernel versions up to and including 4.19.6.

Can CVE-2018-19824 be exploited remotely?

No, CVE-2018-19824 requires local access to exploit the vulnerability through a malicious USB sound device.

What kind of systems are vulnerable to CVE-2018-19824?

Systems running vulnerable versions of the Linux kernel, including Red Hat, Debian, and Ubuntu distributions, are susceptible to CVE-2018-19824.

CVE-2018-19824: Use After Free

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2018-19824?

How do I fix CVE-2018-19824?

Which Linux versions are affected by CVE-2018-19824?

Can CVE-2018-19824 be exploited remotely?

What kind of systems are vulnerable to CVE-2018-19824?

Company

Resources

Contact