CVE-2019-15505: Critical severity Linux Linux kernel vulnerability
A vulnerability was found in technisatusb2getir in drivers/media/usb/dvb-usb/technisat-usb2.c in DVB USB subsystem, there was an out-of-bounds read for an array in struct technisatusb2state state->buf with no boundary check applied until 0xff byte is encountered, if it is not found with in the limits it goes beyond the array size, this exposes kernel data structure which should not happen.
Reference: https://lore.kernel.org/linux-media/20190821104408.w7krumcglxo6fz5q@gofer.mess.org/ https://git.linuxtv.org/mediatree.git/commit/?id=0c4df39e504bf925ab666132ac3c98d6cbbe380b https://lore.kernel.org/lkml/b9b256cb-95f2-5fa1-9956-5a602a017c11@gmail.com/
Other sources
drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through ...
— Debian
Linux Kernel could allow a physical attacker to obtain sensitive information, caused by an out-of-bounds read flaw in technisat-usb2.c. By using a specially-crafted USB device, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service condition on the system.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15505?
CVE-2019-15505 has a medium severity level as it can lead to potential information disclosure due to out-of-bounds reads.
How do I fix CVE-2019-15505?
To fix CVE-2019-15505, you should upgrade your Linux kernel to version 5.10.223-1 or later.
Which systems are affected by CVE-2019-15505?
CVE-2019-15505 affects various versions of the Linux kernel prior to versions that include the fix for this vulnerability.
What type of vulnerability is CVE-2019-15505?
CVE-2019-15505 is categorized as an out-of-bounds read vulnerability in the DVB USB subsystem of the Linux kernel.
Are there any known exploits for CVE-2019-15505?
As of now, no public exploits for CVE-2019-15505 have been reported.