The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.
CVSS Details
- CVSS 3.1 Base Score: 4.6
- CVSS 3.0 Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernelUpgrade kernel-rt | Nov 6, 2019 | Mar 21, 2019 |
| Debian | — | Upgrade linux | Mar 28, 2019 | Mar 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade perfUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-tools-libsUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-develUpgrade kernel | May 1, 2019 | Mar 21, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade kernel-toolsUpgrade kernel-headersUpgrade perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-develUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo | May 30, 2019 | Mar 21, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-tools-libsUpgrade kernel-develUpgrade perfUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headers | May 1, 2019 | Mar 21, 2019 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | May 16, 2019 | Dec 12, 2018 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Mar 21, 2019 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Nov 6, 2019 | Mar 21, 2019 |
| Suse | — | Upgrade kernel-obs-buildUpgrade kernel-source-azureUpgrade kernel-devel-azureUpgrade kernel-defaultUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-azure-baseUpgrade kernel-default-man | Jan 18, 2019 | Jan 18, 2019 |
| Ubuntu | — | Upgrade linux-image-4.15.0-1022-oracleUpgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-powerpc-smpUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.15.0-60-genericUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-powerpc64-smp-lts-xenialUpgrade linux-image-4.4.0-143-generic-lpaeUpgrade linux-image-lowlatencyUpgrade linux-image-genericUpgrade linux-image-4.4.0-143-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-powerpc64-embUpgrade linux-image-gke-4.15Upgrade linux-image-4.4.0-1108-snapdragonUpgrade linux-image-oracleUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-4.15.0-60-lowlatencyUpgrade linux-image-4.15.0-1056-azureUpgrade linux-image-raspi2Upgrade linux-image-4.15.0-1044-raspi2Upgrade linux-image-powerpc-e500mcUpgrade linux-image-generic-lpaeUpgrade linux-image-virtualUpgrade linux-image-powerpc64-emb-lts-xenialUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-aws-hweUpgrade linux-image-4.4.0-143-powerpc64-smpUpgrade linux-image-4.15.0-1041-gcpUpgrade linux-image-powerpc64-smpUpgrade linux-image-4.15.0-1047-awsUpgrade linux-image-kvmUpgrade linux-image-4.4.0-143-genericUpgrade linux-image-4.4.0-1077-awsUpgrade linux-image-azureUpgrade linux-image-4.15.0-1043-kvmUpgrade linux-image-powerpc-e500mc-lts-xenialUpgrade linux-image-4.4.0-1104-raspi2Upgrade linux-image-powerpc-smp-lts-xenialUpgrade linux-image-4.4.0-143-powerpc-e500mcUpgrade linux-image-4.4.0-1041-kvmUpgrade linux-image-snapdragonUpgrade linux-image-awsUpgrade linux-image-4.4.0-143-powerpc-smpUpgrade linux-image-4.4.0-1039-awsUpgrade linux-image-4.4.0-143-powerpc64-embUpgrade linux-image-4.15.0-1041-gkeUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-oemUpgrade linux-image-4.15.0-60-generic-lpaeUpgrade linux-image-gke | Apr 1, 2019 | Jan 18, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 17, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub