Information disclosure in Linux kernel - CVE-2019-19536
Published: July 15, 2020
Vulnerability identifier: #VU29947
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-19536
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in drivers/net/can/usb/peak_usb/pcan_usb_pro.c USB driver. A local user can use a specially crafted USB device to gain unauthorized access to sensitive information on the system.
Affected software
Linux kernel
Oracle VM Server for x86
RSA Authentication Manager
Oracle VM Server for x86
RSA Authentication Manager
How to mitigate CVE-2019-19536
Install updates from vendor's website.
Linux kernel - update to 5.2.9
RSA Authentication Manager - update to 8.4 Patch 10
RSA Authentication Manager - update to 8.4 Patch 10
External References
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
- http://www.openwall.com/lists/oss-security/2019/12/03/4
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.9
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ead16e53c2f0ed946d82d4037c630e2f60f4ab69
- https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html
- https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html