CVE-2019-15099: Null Pointer Dereference
A flaw in the Linux kernels implementation of the ath10k USB device driver could allow an attacker with the ability to plug in custom-crafted hardware to create a null pointer dereference via an incomplete address in an endpoint descriptor.
This will crash the system.
Upstream Patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bfd6e6e6c5d2ee43a3d9902b36e01fc7527ebb27
Other sources
A null pointer dereference flaw was discovered in the Linux kernel's implementation of the ath10k USB device driver. The vulnerability requires the attacker to plug in a specially crafted hardware device that present endpoint descriptors that normal ath10k devices do not recognize. System availability is the highest threat with this vulnerability.
drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-15099?
CVE-2019-15099 is classified as a high severity vulnerability that can lead to system crashes.
How do I fix CVE-2019-15099?
To remediate CVE-2019-15099, update your Linux kernel to a patched version, such as 4.14.0-115.19.1.el7a or 4.18.0-193.rt13.51.el8.
Which systems are affected by CVE-2019-15099?
CVE-2019-15099 affects certain versions of the Linux kernel, specifically those from 4.14.x to 5.4.0.
What impact does CVE-2019-15099 have on my system?
CVE-2019-15099 can cause a null pointer dereference, leading to a crash when a specially crafted device is connected.
Who is impacted by CVE-2019-15099?
Users and organizations running vulnerable versions of the Linux kernel could be impacted by CVE-2019-15099.