CVE-2019-19530: Use After Free
A use-after-free flaw was found in the acmprobe USB subsystem in the Linux kernel. A race condition occurs when a destroy() procedure is initiated allowing the refcount to decrement on the interface so early that it is never under counted. A malicious USB device is required for exploit. System availability is the largest threat from the vulnerability, however data integrity and confidentiality are also threatened.
Other sources
In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef.
In the Linux kernel, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver
References:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.10 http://www.openwall.com/lists/oss-security/2019/12/03/4 http://seclists.org/oss-sec/2019/q4/115 Upstream Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c52873e5a1ef72f845526d9f6a50704433f9c625
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-19530?
CVE-2019-19530 has a high severity level due to the potential exploitation via malicious USB devices.
How do I fix CVE-2019-19530?
To fix CVE-2019-19530, upgrade your kernel to versions 0:3.10.0-1160.rt56.1131.el7 or 0:3.10.0-1160.el7.
What systems are affected by CVE-2019-19530?
CVE-2019-19530 affects various Linux kernel versions including those used in Red Hat, Debian, and openSUSE.
What are the implications of exploiting CVE-2019-19530?
Exploiting CVE-2019-19530 could allow attackers to execute arbitrary code and gain elevated privileges.
Is a specific type of device required to exploit CVE-2019-19530?
Yes, exploiting CVE-2019-19530 requires a malicious USB device.