Linux Kernel up to 5.3.11 spi-fsl-lpspi.c fsl_lpspi_probe resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 5.3.11. Affected is the function fsl_lpspi_probe of the file drivers/spi/spi-fsl-lpspi.c. Performing a manipulation results in resource consumption. This vulnerability is identified as CVE-2019-19064. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 5.3.11 (Operating System). This affects the function fsl_lpspi_probe of the file drivers/spi/spi-fsl-lpspi.c. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

A memory leak in the fsl_lpspi_probe() function in drivers/spi/spi-fsl-lpspi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering pm_runtime_get_sync() failures, aka CID-057b8945f78f.

The weakness was released 11/18/2019. This vulnerability is uniquely identified as CVE-2019-19064 since 11/18/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/05/2024). MITRE ATT&CK project uses the attack technique T1499 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-145885, VDB-145884, VDB-145883 and VDB-145882. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion