Use-after-free in Linux kernel - CVE-2019-19530

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU30566

Use-after-free in Linux kernel - CVE-2019-19530

Published: December 3, 2019 / Updated: July 17, 2020


Vulnerability identifier: #VU30566
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-19530
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to use-after-free error in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef. A local user can use a malicious USB device to trigger use-after-free error and execute arbitrary code on the system with elevated privileges.


Affected software

Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Workstation
kernel (Red Hat package)
kernel-rt (Red Hat package)
RSA Authentication Manager

How to mitigate CVE-2019-19530

Update to version 5.2.10.

Linux kernel - update to 5.2.10
kernel (Red Hat package) - update to 3.10.0-1160.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.rt56.1131.el7
RSA Authentication Manager - update to 8.4 Patch 10

External References

Related Security Bulletins