Linux Kernel up to 5.3.11 cx23888-ir.c cx23888_ir_probe resource consumption

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.3.11. It has been classified as problematic. Affected by this vulnerability is the function cx23888_ir_probe of the file drivers/media/pci/cx23885/cx23888-ir.c. The manipulation leads to resource consumption. This vulnerability is documented as CVE-2019-19054. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.3.11 (Operating System). It has been rated as problematic. This issue affects the function cx23888_ir_probe of the file drivers/media/pci/cx23885/cx23888-ir.c. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures, aka CID-a7b2df76b42b.

The weakness was released 11/18/2019. The identification of this vulnerability is CVE-2019-19054 since 11/18/2019. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/23/2024). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-145875, VDB-145874, VDB-145873 and VDB-145872. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion