Linux Kernel up to 5.3.11 usb.c ath10k_usb_hif_tx_sg resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 5.3.11. This affects the function ath10k_usb_hif_tx_sg of the file drivers/net/wireless/ath/ath10k/usb.c. The manipulation leads to resource consumption. This vulnerability is referenced as CVE-2019-19078. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.3.11 (Operating System) and classified as problematic. This issue affects the function ath10k_usb_hif_tx_sg of the file drivers/net/wireless/ath/ath10k/usb.c. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2.

The weakness was published 11/18/2019. The identification of this vulnerability is CVE-2019-19078 since 11/18/2019. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/23/2024). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-145899, VDB-145898, VDB-145897 and VDB-145896. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion