CVE-2019-19534: Infoleak
An information-leak flaw was found in the Linux kernel's pcan USB driver. When a device using this driver connects to the system, the stack information is leaked to the CAN bus, a controller area network for automobiles. The highest threat with this vulnerability is breach of data confidentiality.
Other sources
In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peakusb/pcanusbcore.c driver, aka CID-f7a1337f0d29.
In the Linux kernel, there is an information leak caused by a malicious USB device in the drivers/net/can/usb/peakusb/pcanusbcore.c
Upstream Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f7a1337f0d29b98733c8824e165fca3371d7d4fd
References:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11 http://seclists.org/oss-sec/2019/q4/115 https://www.openwall.com/lists/oss-security/2019/12/03/4
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.rt13.51.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.12-1Fixed in 7.1.13-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.3.11 - Configuration
Prevent the peak_usb module from auto-loading by creating/updating /etc/modprobe.d/disable-peak-usb-canbus.conf with: `install peak_usb /bin/true` (restart required if the peak_usb module is already loaded).
Linux kernel module loader (modprobe) for peak_usb /etc/modprobe.d/disable-peak-usb-canbus.conf (install line) = /bin/true
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-19534?
The severity of CVE-2019-19534 is high due to its potential to breach data confidentiality.
How do I fix CVE-2019-19534?
To fix CVE-2019-19534, update your kernel to the recommended versions specified in the security advisories.
Which software versions are affected by CVE-2019-19534?
CVE-2019-19534 affects various versions of the Linux kernel, specifically those prior to version 5.3.11 and certain Red Hat kernel versions.
What type of vulnerability is CVE-2019-19534?
CVE-2019-19534 is an information-leak vulnerability found in the Linux kernel's pcan USB driver.
Who is impacted by CVE-2019-19534?
Users and systems using affected versions of the Linux kernel with the pcan USB driver are impacted by CVE-2019-19534.