CVE-2019-19526: Use After Free

Q: What is the severity of CVE-2019-19526?

CVE-2019-19526 is categorized as a medium severity vulnerability due to its potential to be exploited by a malicious USB device.

Q: How do I fix CVE-2019-19526?

To fix CVE-2019-19526, upgrade your Linux kernel to version 5.3.9 or later, or apply the relevant patches provided by your distribution.

Q: Which systems are affected by CVE-2019-19526?

CVE-2019-19526 affects the Linux kernel versions prior to 5.3.9, as well as specific distributions like Ubuntu 18.04, Ubuntu 19.04, and openSUSE Leap 15.1.

Q: What type of vulnerability is CVE-2019-19526?

CVE-2019-19526 is a use-after-free vulnerability found in the nfcpn533 USB driver of the Linux kernel.

Q: What can an attacker gain by exploiting CVE-2019-19526?

If successfully exploited, CVE-2019-19526 can allow an attacker to execute arbitrary code, potentially leading to a system compromise.

Published Dec 3, 2019

Updated

In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098.

Affected Software

46 affected componentsFixes available

Linux Linux kernel<5.3.9

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=19.04

openSUSE Leap=15.1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-1

ubuntu/linux-azure<4.15.0-1064.69~14.04.1

4.15.0-1064.69~14.04.1

ubuntu/linux-aws-hwe<4.15.0-1056.58~16.04.1

4.15.0-1056.58~16.04.1

ubuntu/linux-azure<4.15.0-1064.69

4.15.0-1064.69

ubuntu/linux-gcp<4.15.0-1050.53

4.15.0-1050.53

ubuntu/linux-hwe<4.15.0-72.81~16.04.1

4.15.0-72.81~16.04.1

ubuntu/linux-oracle<4.15.0-1030.33~16.04.1

4.15.0-1030.33~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux<4.15.0-72.81

4.15.0-72.81

ubuntu/linux-aws<4.15.0-1056.58

4.15.0-1056.58

ubuntu/linux-aws-5.0<5.0.0-1023.26~18.04.1

5.0.0-1023.26~18.04.1

ubuntu/linux-azure<5.0.0-1028.30~18.04.1

5.0.0-1028.30~18.04.1

ubuntu/linux-azure-5.3<5.3.0-1008.9~18.04.1

5.3.0-1008.9~18.04.1

ubuntu/linux-gcp<5.0.0-1028.29~18.04.1

5.0.0-1028.29~18.04.1

ubuntu/linux-gcp-5.3<5.3.0-1009.10~18.04.1

5.3.0-1009.10~18.04.1

ubuntu/linux-gke-4.15<4.15.0-1049.52

4.15.0-1049.52

ubuntu/linux-gke-5.0<5.0.0-1027.28~18.04.1

5.0.0-1027.28~18.04.1

ubuntu/linux-hwe<5.3.0-26.28~18.04.1

5.3.0-26.28~18.04.1

ubuntu/linux-kvm<4.15.0-1051.51

4.15.0-1051.51

ubuntu/linux-oem<4.15.0-1065.75

4.15.0-1065.75

ubuntu/linux-oem-osp1<5.0.0-1033.38

5.0.0-1033.38

ubuntu/linux-oracle<4.15.0-1030.33

4.15.0-1030.33

ubuntu/linux-oracle-5.0<5.0.0-1009.14~18.04.1

5.0.0-1009.14~18.04.1

ubuntu/linux-raspi2<4.15.0-1052.56

4.15.0-1052.56

ubuntu/linux-snapdragon<4.15.0-1069.76

4.15.0-1069.76

ubuntu/linux-azure-edge*

ubuntu/linux-gcp-edge*

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-fips<4.15.0-2018.18

4.15.0-2018.18

ubuntu/linux-azure-fips<4.15.0-2006.7

4.15.0-2006.7

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-azure-fde*

ubuntu/linux-gke*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1064.69~14.04.1
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1056.58~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1064.69
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1050.53
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-72.81~16.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1030.33~16.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-72.81
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1056.58
Upgrade
Upgrade ubuntu/linux-aws-5.0 to a version that resolves this vulnerability.
Fixed in 5.0.0-1023.26~18.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.0.0-1028.30~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.3 to a version that resolves this vulnerability.
Fixed in 5.3.0-1008.9~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.0.0-1028.29~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.3 to a version that resolves this vulnerability.
Fixed in 5.3.0-1009.10~18.04.1
Upgrade
Upgrade ubuntu/linux-gke-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1049.52
Upgrade
Upgrade ubuntu/linux-gke-5.0 to a version that resolves this vulnerability.
Fixed in 5.0.0-1027.28~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 5.3.0-26.28~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1051.51
Upgrade
Upgrade ubuntu/linux-oem to a version that resolves this vulnerability.
Fixed in 4.15.0-1065.75
Upgrade
Upgrade ubuntu/linux-oem-osp1 to a version that resolves this vulnerability.
Fixed in 5.0.0-1033.38
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1030.33
Upgrade
Upgrade ubuntu/linux-oracle-5.0 to a version that resolves this vulnerability.
Fixed in 5.0.0-1009.14~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.
Fixed in 4.15.0-1052.56
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.15.0-1069.76
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2018.18
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2006.7

Event History

Dec 3, 2019

CVE Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

RemedyDescriptionSeverityAffected Software

CVE Published

via MITRE·03:41 PM

Data Sourced

via MITRE·03:41 PM

Description

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-19526?

CVE-2019-19526 is categorized as a medium severity vulnerability due to its potential to be exploited by a malicious USB device.

How do I fix CVE-2019-19526?

To fix CVE-2019-19526, upgrade your Linux kernel to version 5.3.9 or later, or apply the relevant patches provided by your distribution.

Which systems are affected by CVE-2019-19526?

CVE-2019-19526 affects the Linux kernel versions prior to 5.3.9, as well as specific distributions like Ubuntu 18.04, Ubuntu 19.04, and openSUSE Leap 15.1.

What type of vulnerability is CVE-2019-19526?

CVE-2019-19526 is a use-after-free vulnerability found in the nfcpn533 USB driver of the Linux kernel.

What can an attacker gain by exploiting CVE-2019-19526?

If successfully exploited, CVE-2019-19526 can allow an attacker to execute arbitrary code, potentially leading to a system compromise.

CVE-2019-19526: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2019-19526?

How do I fix CVE-2019-19526?

Which systems are affected by CVE-2019-19526?

What type of vulnerability is CVE-2019-19526?

What can an attacker gain by exploiting CVE-2019-19526?

Company

Resources

Contact