CVE-2019-19524: Use After Free
A use-after-free flaw was found in the Linux kernel’s input device driver functionality when unplugging a device. A user with physical access could use this flaw to crash the system.
Other sources
In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9.
In the Linux kernel, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c
References:
http://www.openwall.com/lists/oss-security/2019/12/03/4 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.12 http://seclists.org/oss-sec/2019/q4/115
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa3a5a1880c91bb92594ad42dfe9eedad7996b86
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.21.2.el7a - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.rt7.54.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 5.3.12Patch CID-fa3a5a1880c9 - Configuration
For Red Hat Enterprise Linux 7 or higher, prevent the kernel module ff-memless from being loaded by blacklisting the module (per the referenced Red Hat solution).
Linux kernel module ff-memless module loading (blacklist to prevent auto-load) = enabled (blacklisted so it does not load automatically)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-19524?
CVE-2019-19524 is classified as a high severity vulnerability due to its potential to allow system crashes with physical access.
How do I fix CVE-2019-19524?
To fix CVE-2019-19524, ensure your kernel version is updated to at least 5.3.12 or the appropriate patched version for your distribution.
What systems are affected by CVE-2019-19524?
CVE-2019-19524 affects various Linux kernel versions prior to 5.3.12, including specific versions of Red Hat, Ubuntu, Debian, and Android.
Can CVE-2019-19524 be exploited remotely?
No, exploitation of CVE-2019-19524 requires physical access to the vulnerable system through a malicious USB device.
What type of vulnerability is CVE-2019-19524?
CVE-2019-19524 is a use-after-free vulnerability in the Linux kernel's input device driver functionality.