Vulnerability Details : CVE-2019-15917

An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c.

Vulnerability category: Memory Corruption

Published 2019-09-04 19:15:12

Updated 2023-08-11 19:54:53

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-15917

Probability of exploitation activity in the next 30 days: 0.05%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 12 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2019-15917

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C	3.4	10.0	[email protected]
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.0	HIGH	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.0	5.9	[email protected]
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-15917

CWE-416 Use After Free

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Assigned by: [email protected] (Primary)

References for CVE-2019-15917

https://seclists.org/bugtraq/2020/Jan/10

Mailing List;Third Party Advisory

CVEs referencing this url
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.5

Release Notes
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html

Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20191004-0001/

Third Party Advisory

CVEs referencing this url
https://github.com/torvalds/linux/commit/56897b217a1d0a91c9920cb418d6b3fe922f590a

Patch
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html

Third Party Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

Third Party Advisory;VDB Entry

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html

Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html

Third Party Advisory

CVEs referencing this url

Products affected by CVE-2019-15917

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.7 and before (<) 4.9.202
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.20 and before (<) 5.0.5
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.15 and before (<) 4.19.32
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.12.61 and before (<) 3.13
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.10 and before (<) 4.14.109
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.0
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions