CVE-2019-19527: Use After Free
A vulnerability was found in hiddevopen in drivers/hid/usbhid/hiddev.c in USB human interface device class subsystem, in this problem if a USB device fails to initialize correctly list management code in the error handling path can delete a list entry while other USB code paths could be using it. This may lead to a use-after-free situation which is frequently used by attackers to corrupt memory, panic the system or possibly escalate privileges.
Upstream Patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d4472d7bec39917b54e4e80245784ea5d60ce49 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9c09b214f30e3c11f9b0b03f89442df03643794d
References:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.10 http://www.openwall.com/lists/oss-security/2019/12/03/4 http://seclists.org/oss-sec/2019/q4/115
Other sources
A vulnerability was found in hiddevopen in drivers/hid/usbhid/hiddev.c in the USB Human Interface Device class subsystem, where an existing device must be validated prior to its access. The device should also ensure the hiddevlist cleanup occurs at failure, as this may lead to a use-after-free problem, or possibly escalate privileges to an unauthorized user.
In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1127.18.2.rt56.1116.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1127.18.2.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.36.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.8.1.rt24.101.el8_1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.8.1.el8_1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.2.10
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-19527?
CVE-2019-19527 has a medium severity due to the potential for exploitation via a malicious USB device.
How do I fix CVE-2019-19527?
To fix CVE-2019-19527, update to the latest kernel versions that are above 5.2.10 or apply the appropriate patches as provided by your Linux distribution.
What systems are affected by CVE-2019-19527?
CVE-2019-19527 affects various Linux kernel versions prior to 5.2.10, including specific Red Hat and Debian releases.
What type of vulnerability is CVE-2019-19527?
CVE-2019-19527 is classified as a use-after-free vulnerability in the Linux kernel's USB HID driver.
Can CVE-2019-19527 be exploited remotely?
Yes, CVE-2019-19527 can potentially be exploited when a user connects a malicious USB device to the affected system.