Memory leak in Linux kernel - CVE-2019-18809

Vulnerability identifier: #VU24442

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-18809

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the "af9005_identify_state()" function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows a local user to cause a denial of service (memory consumption).

Linux kernel
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Fedora
kernel (Red Hat package)
kernel

Install update from vendor's website.

Linux kernel - update to 5.3.10
kernel (Red Hat package) - update to 4.18.0-240.el8
kernel - addressed in versions 5.3.14-200.fc30, 5.3.14-300.fc31

• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
• https://github.com/torvalds/linux/commit/2289adbfa559050d2a38bcd9caac1c18b800e928
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYIFGYEDQXP5DVJQQUARQRK2PXKBKQGY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YWWOOJKZ4NQYN4RMFIVJ3ZIXKJJI3MKP/
• https://security.netapp.com/advisory/ntap-20191205-0001/

• Multiple vulnerabilities in Linux kernel
• Red Hat Enterprise Linux 8 update for kernel
• Fedora 31 update for kernel
• Fedora 30 update for kernel