Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.4
CVE-2019-19534: Linux Kernel USB Driver Exposes Sensitive Information
CVE-2019-19534 · published 6 years ago
Summary
A security issue in the Linux kernel's USB driver for CAN devices can allow a malicious USB device to leak sensitive information. This issue affects systems running Linux kernel versions prior to 5.3.11. To ensure security, update the Linux kernel to the latest version or apply the recommended patch.
What to do
- Update canonical linux-aws to version 4.4.0-1060.64.
- Update canonical linux-azure to version 4.15.0-1066.71~14.04.1.
- Update canonical linux-lts-xenial to version 4.4.0-171.200~14.04.1.
- Update canonical linux to version 4.4.0-171.200.
- Update canonical linux-aws to version 4.4.0-1100.111.
- Update canonical linux-aws-hwe to version 4.15.0-1057.59~16.04.1.
- Update canonical linux-azure to version 4.15.0-1066.71.
- Update canonical linux-gcp to version 4.15.0-1052.56.
- Update canonical linux-hwe to version 4.15.0-74.83~16.04.1.
- Update canonical linux-kvm to version 4.4.0-1064.71.
- Update canonical linux-oracle to version 4.15.0-1031.34~16.04.1.
- Update canonical linux-raspi2 to version 4.4.0-1127.136.
- Update canonical linux-snapdragon to version 4.4.0-1131.139.
- Update canonical linux-fips to version 4.4.0-1027.32.
- Update canonical linux to version 4.15.0-74.84.
- Update canonical linux-aws to version 4.15.0-1057.59.
- Update canonical linux-aws-5.0 to version 5.0.0-1023.26~18.04.1.
- Update canonical linux-azure to version 5.0.0-1028.30~18.04.1.
- Update canonical linux-azure-5.3 to version 5.3.0-1009.10~18.04.1.
- Update canonical linux-gcp to version 5.0.0-1028.29~18.04.1.
- Update canonical linux-gcp-5.3 to version 5.3.0-1010.11~18.04.1.
- Update canonical linux-gke-4.15 to version 4.15.0-1050.53.
- Update canonical linux-gke-5.0 to version 5.0.0-1027.28~18.04.1.
- Update canonical linux-hwe to version 5.3.0-26.28~18.04.1.
- Update canonical linux-kvm to version 4.15.0-1052.52.
- Update canonical linux-oem to version 4.15.0-1066.76.
- Update canonical linux-oem-osp1 to version 5.0.0-1033.38.
- Update canonical linux-oracle to version 4.15.0-1031.34.
- Update canonical linux-oracle-5.0 to version 5.0.0-1009.14~18.04.1.
- Update canonical linux-raspi2 to version 4.15.0-1053.57.
- Update canonical linux-snapdragon to version 4.15.0-1070.77.
- Update canonical linux-aws-fips to version 4.15.0-2018.18.
- Update canonical linux-azure-fips to version 4.15.0-2006.7.
- Update linux linux_kernel to version 5.3.11 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | linux-aws |
< 4.4.0-1060.64 Fix: upgrade to 4.4.0-1060.64
|
| Ubuntu:Pro:14.04:LTS | canonical | linux-azure |
< 4.15.0-1066.71~14.04.1 Fix: upgrade to 4.15.0-1066.71~14.04.1
|
| Ubuntu:Pro:14.04:LTS | canonical | linux-lts-xenial |
< 4.4.0-171.200~14.04.1 Fix: upgrade to 4.4.0-171.200~14.04.1
|
| Ubuntu:Pro:14.04:LTS | canonical | linux | All versions |
| Ubuntu:16.04:LTS | canonical | linux |
< 4.4.0-171.200 Fix: upgrade to 4.4.0-171.200
|
| Ubuntu:16.04:LTS | canonical | linux-aws |
< 4.4.0-1100.111 Fix: upgrade to 4.4.0-1100.111
|
| Ubuntu:16.04:LTS | canonical | linux-aws-hwe |
< 4.15.0-1057.59~16.04.1 Fix: upgrade to 4.15.0-1057.59~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-azure |
< 4.15.0-1066.71 Fix: upgrade to 4.15.0-1066.71
|
| Ubuntu:16.04:LTS | canonical | linux-gcp |
< 4.15.0-1052.56 Fix: upgrade to 4.15.0-1052.56
|
| Ubuntu:16.04:LTS | canonical | linux-hwe |
< 4.15.0-74.83~16.04.1 Fix: upgrade to 4.15.0-74.83~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-kvm |
< 4.4.0-1064.71 Fix: upgrade to 4.4.0-1064.71
|
| Ubuntu:16.04:LTS | canonical | linux-oracle |
< 4.15.0-1031.34~16.04.1 Fix: upgrade to 4.15.0-1031.34~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-raspi2 |
< 4.4.0-1127.136 Fix: upgrade to 4.4.0-1127.136
|
| Ubuntu:16.04:LTS | canonical | linux-snapdragon |
< 4.4.0-1131.139 Fix: upgrade to 4.4.0-1131.139
|
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:FIPS:16.04:LTS | canonical | linux-fips |
< 4.4.0-1027.32 Fix: upgrade to 4.4.0-1027.32
|
| Ubuntu:18.04:LTS | canonical | linux |
< 4.15.0-74.84 Fix: upgrade to 4.15.0-74.84
|
| Ubuntu:18.04:LTS | canonical | linux-aws |
< 4.15.0-1057.59 Fix: upgrade to 4.15.0-1057.59
|
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 |
< 5.0.0-1023.26~18.04.1 Fix: upgrade to 5.0.0-1023.26~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-azure |
< 5.0.0-1028.30~18.04.1 Fix: upgrade to 5.0.0-1028.30~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 |
< 5.3.0-1009.10~18.04.1 Fix: upgrade to 5.3.0-1009.10~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gcp |
< 5.0.0-1028.29~18.04.1 Fix: upgrade to 5.0.0-1028.29~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 |
< 5.3.0-1010.11~18.04.1 Fix: upgrade to 5.3.0-1010.11~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 |
< 4.15.0-1050.53 Fix: upgrade to 4.15.0-1050.53
|
| Ubuntu:18.04:LTS | canonical | linux-gke-5.0 |
< 5.0.0-1027.28~18.04.1 Fix: upgrade to 5.0.0-1027.28~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-hwe |
< 5.3.0-26.28~18.04.1 Fix: upgrade to 5.3.0-26.28~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-kvm |
< 4.15.0-1052.52 Fix: upgrade to 4.15.0-1052.52
|
| Ubuntu:18.04:LTS | canonical | linux-oem |
< 4.15.0-1066.76 Fix: upgrade to 4.15.0-1066.76
|
| Ubuntu:18.04:LTS | canonical | linux-oem-osp1 |
< 5.0.0-1033.38 Fix: upgrade to 5.0.0-1033.38
|
| Ubuntu:18.04:LTS | canonical | linux-oracle |
< 4.15.0-1031.34 Fix: upgrade to 4.15.0-1031.34
|
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 |
< 5.0.0-1009.14~18.04.1 Fix: upgrade to 5.0.0-1009.14~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-raspi2 |
< 4.15.0-1053.57 Fix: upgrade to 4.15.0-1053.57
|
| Ubuntu:18.04:LTS | canonical | linux-snapdragon |
< 4.15.0-1070.77 Fix: upgrade to 4.15.0-1070.77
|
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-aws-fips |
< 4.15.0-2018.18 Fix: upgrade to 4.15.0-2018.18
|
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-azure-fips |
< 4.15.0-2006.7 Fix: upgrade to 4.15.0-2006.7
|
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield | All versions |
Showing 50 of 53. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
< 5.3.11 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
8.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
14.04 16.04 18.04 19.04 19.10 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
Original advisory text
In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29.
In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29.
References
- http://www.openwall.com/lists/oss-security/2019/12/03/4 Third Party Advisory
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11 Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f7... Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html Mailing List Third Party Advisory
- https://ubuntu.com/security/CVE-2019-19534 Third Party Advisory
- https://git.kernel.org/linus/f7a1337f0d29b98733c8824e165fca3371d7d4fd Third Party Advisory
- https://ubuntu.com/security/notices/USN-4225-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4226-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4227-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4228-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4227-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4228-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4225-2 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-19534 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html Mailing List Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html Mailing List Third Party Advisory
- https://usn.ubuntu.com/4225-1/ Third Party Advisory
- https://usn.ubuntu.com/4225-2/ Third Party Advisory
- https://usn.ubuntu.com/4226-1/ Third Party Advisory
- https://usn.ubuntu.com/4227-1/ Third Party Advisory
- https://usn.ubuntu.com/4227-2/ Third Party Advisory
- https://usn.ubuntu.com/4228-1/ Third Party Advisory
- https://usn.ubuntu.com/4228-2/ Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-909Missing Initialization of Resource
Timeline
Published3 Dec 2019
Updated4 Nov 2026
First seen15 Mar 2026
Track software like this
Free during beta