CVE-2019-19061

Description

A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-9c0530e898f3.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v2.0•HIGH•Score: 7.8AV:N/AC:L/Au:N/C:N/I:N/A:C

EPSS Trends

Current EPSS score: 1.11%• Percentile: 78%

Techniques & Countermeasures

• CWE-401•Missing Release of Memory after Effective Lifetime

  The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Systems

• broadcom•brocade_fabric_operating_system

  na

• canonical•ubuntu_linux

  14.04 | 16.04 | 18.04 | 19.10

• linux•linux_kernel

  ≥ 3.9, < 4.4.262 | ≥ 4.5, < 4.9.262 | ≥ 4.10, < 4.14.192 | ≥ 4.15, < 4.19.137 | ≥ 4.20, < 5.3.9

• netapp•active_iq_unified_manager

  na

• netapp•aff_baseboard_management_controller

  na

• netapp•cloud_backup

  na

• netapp•data_availability_services

  na

• netapp•e-series_santricity_os_controller

  11.0 | 11.0.0 | 11.20 | 11.25 | 11.30 | 11.30.5r3 | 11.40 | 11.40.3r2 | 11.40.5 | 11.50.1 | 11.50.2 | 11.50.2:p1 | 11.60 | 11.60.0 | 11.60.1 | 11.60.3 | 11.70.1 | 11.70.2

• netapp•fas\/aff_baseboard_management_controller

  na

• netapp•hci_baseboard_management_controller

  h610s

• netapp•hci_compute_node_firmware

  na

• netapp•solidfire_\&_hci_management_node

  na

• netapp•solidfire_baseboard_management_controller_firmware

  na

• netapp•solidfire\,_enterprise_sds_\&_hci_storage_node

  na

• netapp•steelstore_cloud_integrated_storage

  na

References (5)

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9
• https://github.com/torvalds/linux/commit/9c0530e898f384c5d279bfcebd8bb17af1105873
• https://usn.ubuntu.com/4208-1/
• https://security.netapp.com/advisory/ntap-20191205-0001/
• https://usn.ubuntu.com/4526-1/