CVE-2019-15213

Published: 19 August 2019

An issue was discovered in the Linux kernel before 5.2.3. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver.

Priority

Low

CVSS 3 base score: 4.6

Status

Notes

Setting priority to low since this issue requires a malicious USB
device to be inserted into the system
Ben Hutchings noticed that commit 6cf97230cd5f ("media: dvb: usb: fix
use after free in dvb_usb_device_exit"), which is mentioned in the CVE
references for this issue, likely doesn't fix the problem. See the lore
reference above for details. I think Ben is correct and have adjusted our
break-fix metadata to use the break commit that he pointed out.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
• https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
• https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.kernel.org/show_bug.cgi?id=204597