CVE-2019-19055: Medium severity Canonical Ubuntu Linux vulnerability
DISPUTED A memory leak in the nl80211getftmresponderstats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering nl80211hdrput() failures, aka CID-1399c59fa929. NOTE: third parties dispute the relevance of this because it occurs on a code path where a successful allocation has already occurred.
Other sources
A flaw was found in the Linux kernel. The Wireless configuration API functionality mishandles resource cleanup in nl80211getftmresponderstats function. An attacker able to trigger the resource cleanup code path could use this flaw to crash the system. The highest threat from this vulnerability is to system availability.
A memory leak in the nl80211getftmresponderstats() function innet/wireless/nl80211.c allows attackers tocause a denial of service (memory consumption) by triggering nl80211hdrput() failures
Upstream commit:
https://github.com/torvalds/linux/commit/1399c59fa92984836db90538cf92397fe7caaa57
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.rt13.51.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CID-1399c59fa929 - Compensating control
Mitigate the Linux kernel memory leak by blacklisting the kernel module cfg80211 so the affected nl80211 code path is not loaded (see instructions for blacklisting a kernel module).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-19055?
CVE-2019-19055 has a severity rating that may allow attackers to cause a denial of service due to a memory leak.
How do I fix CVE-2019-19055?
To fix CVE-2019-19055, update your Linux kernel to at least version 5.10.223-1 or the recommended versions provided by your distribution.
What systems are affected by CVE-2019-19055?
CVE-2019-19055 affects various Linux distributions, including specific versions of the Red Hat kernel, Ubuntu Linux, and Fedora.
What does CVE-2019-19055 imply for system security?
CVE-2019-19055 implies that systems are at risk of memory consumption issues that can be exploited to disrupt services.
Is there any workaround for CVE-2019-19055?
Currently, the best course of action for CVE-2019-19055 is to apply the security updates provided by your Linux distribution.