CVE-2019-19524
kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free
Severity Score
Exploit Likelihood
Affected Versions
7Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9.
En el kernel de Linux versiones anteriores a 5.3.12, se presenta un bug de uso de la memoria previamente liberada que puede ser causado por un dispositivo USB malicioso en el controlador del archivo drivers/input/ff-memless.c, también se conoce como CID-fa3a5a1880c9.
A use-after-free flaw was found in the Linux kernel’s input device driver functionality when unplugging a device. A user with physical access could use this flaw to crash the system.
It was discovered that a heap-based buffer overflow existed in the Marvell WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code. It was discovered that a heap-based buffer overflow existed in the Marvell Libertas WLAN Driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-12-03 CVE Reserved
- 2019-12-03 CVE Published
- 2024-08-05 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
CAPEC
References (17)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14... | Third Party Advisory |
|
| http://www.openwall.com/lists/oss-security/2019/12/03/4 | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html | Mailing List |
|
| https://seclists.org/bugtraq/2020/Jan/10 | Issue Tracking |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-... | 2022-10-31 | |
| https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.12 | 2022-10-31 | |
| https://usn.ubuntu.com/4225-1 | 2022-10-31 | |
| https://usn.ubuntu.com/4225-2 | 2022-10-31 | |
| https://usn.ubuntu.com/4226-1 | 2022-10-31 | |
| https://usn.ubuntu.com/4227-1 | 2022-10-31 | |
| https://usn.ubuntu.com/4227-2 | 2022-10-31 | |
| https://usn.ubuntu.com/4228-1 | 2022-10-31 | |
| https://usn.ubuntu.com/4228-2 | 2022-10-31 | |
| https://access.redhat.com/security/cve/CVE-2019-19524 | 2020-11-04 |