CVE-2019-15221: Null Pointer Dereference
An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver.
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3450121997ce872eb7f1248417225827ea249710
References:
https://www.openwall.com/lists/oss-security/2019/08/20/2 https://syzkaller.appspot.com/bug?id=240f09164db2c3d3af33a117c713dc7650dc29d6
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15221?
CVE-2019-15221 has been classified as a high-severity vulnerability due to the potential for NULL pointer dereference leading to system crashes.
How do I fix CVE-2019-15221?
To fix CVE-2019-15221, you should upgrade your Linux kernel to version 5.1.17 or later.
Which systems are affected by CVE-2019-15221?
CVE-2019-15221 affects Linux kernel versions prior to 5.1.17, including various distributions like Ubuntu and Debian.
What can an attacker do with CVE-2019-15221?
An attacker could exploit CVE-2019-15221 through a malicious USB device, potentially causing a denial of service by crashing the kernel.
Is there a known exploit for CVE-2019-15221?
As of now, there are no publicly disclosed exploits specifically targeting CVE-2019-15221, but the risk remains significant.