CVE-2019-15217: Null Pointer Dereference
A vulnerability was found in the Linux kernel. The Zr364xx USB device driver is susceptible to malicious USB devices. An attacker able to add a specific USB device could cause a crash leading to a denial of service.
Other sources
A vulnerability was found in the Linux kernel. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.
Reference: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d2e73a5f80a5b5aff3caf1ec6d39b5b3f54b26e https://syzkaller.appspot.com/bug?id=9c0c178c24d828a7378f483309001329750aad64
— Red Hat
An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 7.1.13-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.2.3 - Compensating control
Prevent the Zr364xx USB device driver module (module name: zr364xx) from loading automatically by blacklisting it (per the referenced instructions for blacklisting a kernel module in the provided guidance URL).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-15217?
CVE-2019-15217 has a severity rating classified as medium, affecting the Linux kernel.
How does CVE-2019-15217 affect Linux kernel?
CVE-2019-15217 impacts the Linux kernel through a vulnerability in the Zr364xx USB device driver that can lead to a denial of service.
How do I fix CVE-2019-15217?
To fix CVE-2019-15217, upgrade the Linux kernel to a version that is 0:3.10.0-1160.rt56.1131.el7 or later.
What systems are affected by CVE-2019-15217?
CVE-2019-15217 affects various systems running the Linux kernel versions up to 5.2.3, including specific distributions like Red Hat, Ubuntu, and Debian.
Can CVE-2019-15217 be exploited remotely?
Yes, CVE-2019-15217 can be exploited by connecting a malicious USB device to the vulnerable system.