Use-after-free in Linux kernel - CVE-2019-19523

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU30562

Use-after-free in Linux kernel - CVE-2019-19523

Published: December 3, 2019 / Updated: July 17, 2020


Vulnerability identifier: #VU30562
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-19523
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to use-after-free error in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79. A local user can use a malicious USB device to trigger use-after-free error and execute arbitrary code on the system with elevated privileges.


Affected software

Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Workstation
kernel (Red Hat package)
kernel-rt (Red Hat package)
RSA Authentication Manager

How to mitigate CVE-2019-19523

Update to version 5.3.7.

Linux kernel - update to 5.3.7
kernel (Red Hat package) - update to 3.10.0-1160.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.rt56.1131.el7
RSA Authentication Manager - update to 8.4 Patch 10

External References

Related Security Bulletins