Linux Kernel up to 5.3.11 usb.c rtl_usb_probe resource consumption

Summaryinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.3.11. This impacts the function rtl_usb_probe of the file drivers/net/wireless/realtek/rtlwifi/usb.c. Such manipulation leads to resource consumption. This vulnerability is referenced as CVE-2019-19063. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.3.11 (Operating System). It has been rated as problematic. Affected by this issue is the function rtl_usb_probe of the file drivers/net/wireless/realtek/rtlwifi/usb.c. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113.

The weakness was published 11/18/2019. This vulnerability is handled as CVE-2019-19063 since 11/18/2019. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 222858 (Linux Distros Unpatched Vulnerability : CVE-2019-19063), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (222858). Similar entries are available at VDB-145884, VDB-145883, VDB-145882 and VDB-145881. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion