CVE-2019-19526: Use After Free
In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
Linux kernel (drivers/nfc/pn533/usb.c)to a version that resolves this vulnerability.Fixed in 5.3.9Patch CID-6af3aa57a098
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19526?
CVE-2019-19526 is categorized as a medium severity vulnerability due to its potential to be exploited by a malicious USB device.
How do I fix CVE-2019-19526?
To fix CVE-2019-19526, upgrade your Linux kernel to version 5.3.9 or later, or apply the relevant patches provided by your distribution.
Which systems are affected by CVE-2019-19526?
CVE-2019-19526 affects the Linux kernel versions prior to 5.3.9, as well as specific distributions like Ubuntu 18.04, Ubuntu 19.04, and openSUSE Leap 15.1.
What type of vulnerability is CVE-2019-19526?
CVE-2019-19526 is a use-after-free vulnerability found in the nfcpn533 USB driver of the Linux kernel.
What can an attacker gain by exploiting CVE-2019-19526?
If successfully exploited, CVE-2019-19526 can allow an attacker to execute arbitrary code, potentially leading to a system compromise.