CVE-2019-13631: Medium severity Linux Linux kernel vulnerability
A vulnerability was discovered in the linux kernels implementation of "GTCO tablet/digitizer"s version of parsehidreportdescriptor in drivers.
An attacker with local access could create a malicious USB device which must be inserted into the local usb port to send a crafted USB response that triggers an out-of-bounds write during generation of debugging messages.
It is unlikely that this attack is effective or wide-spread as it requires specific usb hardware and physical access to the hardware to exploit.
Reference: https://patchwork.kernel.org/patch/11040813/
Other sources
In parsehidreportdescriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages.
— MITRE
Linux Kernel could allow a physical attacker to execute arbitrary code on the system, caused by an an out-of-bounds write flaw in the parsehidreportdescriptor function in drivers/input/tablet/gtco.c. By using a specially-crafted USB device to send an HID report, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-13631?
CVE-2019-13631 is classified as a high-severity vulnerability due to its potential for local exploitation with malicious USB devices.
How do I fix CVE-2019-13631?
To mitigate CVE-2019-13631, update your Linux kernel to version 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, or 6.12.10-1.
Who is affected by CVE-2019-13631?
CVE-2019-13631 affects users running vulnerable versions of the Linux kernel up to 5.2.1.
What type of attack can exploit CVE-2019-13631?
CVE-2019-13631 can be exploited by an attacker with local access who inserts a malicious USB device.
Is CVE-2019-13631 a browser vulnerability?
No, CVE-2019-13631 is a vulnerability in the Linux kernel and not related to web browsers.