Use-after-free in Linux kernel - CVE-2019-15214

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU20815

Use-after-free in Linux kernel - CVE-2019-15214

Published: September 3, 2019


Vulnerability identifier: #VU20815
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-15214
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists in the Advanced Linux Sound Architecture (ALSA) subsystem in "sound/core/init.c" and "sound/core/info.c" due to the card disconnection causes certain data structures to be deleted too early. A local authenticated user with physical access to the system can exploit this vulnerability to cause a denial of service (system crash) or possibly execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Affected software

Linux kernel
Oracle VM Server for x86

How to mitigate CVE-2019-15214

Install updates from vendor's website.

Linux kernel - update to 5.0.10

External References

Related Security Bulletins