Vulnerability Description
drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 4.17, < 4.19.74 |
| Canonical | Ubuntu Linux | 18.04 |
Related Weaknesses (CWE)
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lore.kernel.org/lkml/20190819220230.10597-1-benquike%40gmail.com/
- https://security.netapp.com/advisory/ntap-20190905-0002/Third Party Advisory
- https://support.f5.com/csp/article/K33554143Third Party Advisory
- https://support.f5.com/csp/article/K33554143?utm_source=f5support&%3Butm_medi
- https://usn.ubuntu.com/4157-1/Third Party Advisory
- https://usn.ubuntu.com/4157-2/Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lore.kernel.org/lkml/20190819220230.10597-1-benquike%40gmail.com/
- https://security.netapp.com/advisory/ntap-20190905-0002/Third Party Advisory
- https://support.f5.com/csp/article/K33554143Third Party Advisory
- https://support.f5.com/csp/article/K33554143?utm_source=f5support&%3Butm_medi
- https://usn.ubuntu.com/4157-1/Third Party Advisory
FAQ
What is CVE-2019-15504?
CVE-2019-15504 is a vulnerability with a CVSS score of 9.8 (CRITICAL). drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).
How severe is CVE-2019-15504?
CVE-2019-15504 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-15504?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Canonical Ubuntu Linux.