Vulnerability Name:

CVE-2019-19947 (CCN-173450)

Assigned:2019-12-24
Published:2019-12-24
Updated:2022-11-09
Summary:In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c.
CVSS v3 Severity:4.6 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
4.0 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-908
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2019-19947

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20191224 CVE-2019-19947: Linux kernel can: kvaser_usb: kvaser_usb_leaf: some info-leaks vulnerabilities

Source: XF
Type: UNKNOWN
linux-kernel-cve201919947-info-disc(173450)

Source: CCN
Type: Linux Kernel GIT Repository
can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/da2311a6385c3b499da2ed5d9be59ce331fa93e9

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20200118 [SECURITY] [DLA 2068-1] linux security update

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20200302 [SECURITY] [DLA 2114-1] linux-4.9 security update

Source: CCN
Type: oss-sec Mailing List, Tue, 24 Dec 2019 10:49:49 +0800
CVE-2019-19947: Linux kernel can: kvaser_usb: kvaser_usb_leaf: some info-leaks vulnerabilities

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20200204-0002/

Source: UBUNTU
Type: Third Party Advisory
USN-4284-1

Source: UBUNTU
Type: Third Party Advisory
USN-4285-1

Source: UBUNTU
Type: Third Party Advisory
USN-4427-1

Source: UBUNTU
Type: Third Party Advisory
USN-4485-1

Source: CCN
Type: IBM Security Bulletin 6116992 (Spectrum Protect Plus)
Multiple vulnerabilities in Linux Kernel affect IBM Spectrum Protect Plus

Vulnerable Configuration:Configuration 1:
  • cpe:/o:linux:linux_kernel:*:*:*:*:*:*:*:* (Version <= 5.4.6)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

    • Configuration 4:
  • cpe:/a:netapp:cloud_backup:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:data_availability_services:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:solidfire_&_hci_management_node:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
  • OR cpe:/h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:fas/aff_baseboard_management_controller:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* (Version >= 11.0 and <= 11.70.2)
  • OR cpe:/a:netapp:hci_baseboard_management_controller:h610s:*:*:*:*:*:*:*
  • OR cpe:/h:netapp:aff_baseboard_management_controller:a700s:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:linux:linux_kernel:5.4.6:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:spectrum_protect_plus:10.1.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:685
    P
    		Security update for bind (Important)
    2022-08-09
    oval:org.opensuse.security:def:201919947
    V
    		CVE-2019-19947
    2022-08-07
    oval:org.opensuse.security:def:665
    P
    		Security update for samba (Moderate)
    2022-08-03
    oval:org.opensuse.security:def:1400
    P
    		Security update for the Linux Kernel (Live Patch 9 for SLE 15 SP3) (Important) (in QA)
    2022-06-27
    oval:org.opensuse.security:def:94590
    P
    		kernel-64kb-5.14.21-150400.22.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95197
    P
    		kernel-default-extra-5.14.21-150400.22.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:3448
    P
    		reiserfs-kmp-default-5.14.21-150400.22.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95028
    P
    		kernel-docs-5.14.21-150400.22.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:3453
    P
    		kernel-azure-5.14.21-150400.12.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95078
    P
    		reiserfs-kmp-default-5.14.21-150400.22.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2960
    P
    		kernel-64kb-5.14.21-150400.22.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:3567
    P
    		kernel-default-extra-5.14.21-150400.22.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95083
    P
    		kernel-azure-5.14.21-150400.12.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:3398
    P
    		kernel-docs-5.14.21-150400.22.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:89
    P
    		kernel-64kb-5.3.18-57.3 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:1792
    P
    		Security update for MozillaThunderbird (Important)
    2021-12-22
    oval:org.opensuse.security:def:49126
    P
    		Security update for runc (Moderate)
    2021-12-14
    oval:org.opensuse.security:def:66952
    P
    		Security update for strongswan (Important)
    2021-10-19
    oval:org.opensuse.security:def:94182
    P
    		 (Important)
    2021-08-17
    oval:org.opensuse.security:def:63125
    P
    		kernel-azure-5.3.18-36.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:2036
    P
    		kernel-azure-5.3.18-36.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63102
    P
    		reiserfs-kmp-default-5.3.18-57.3 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:2013
    P
    		reiserfs-kmp-default-5.3.18-57.3 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:101039
    P
    		perl-Convert-ASN1-0.27-1.6.2 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:71848
    P
    		kernel-64kb-5.3.18-57.3 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:1930
    P
    		kernel-docs-5.3.18-57.3 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100851
    P
    		grub2-2.04-20.4 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62107
    P
    		kernel-64kb-5.3.18-57.3 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100865
    P
    		kernel-64kb-5.3.18-57.3 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100891
    P
    		libXv-devel-1.0.11-1.23 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:1018
    P
    		kernel-64kb-5.3.18-57.3 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101277
    P
    		kernel-docs-5.3.18-57.3 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:72738
    P
    		kernel-docs-5.3.18-57.3 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100895
    P
    		libXxf86vm-devel-1.1.4-1.23 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63019
    P
    		kernel-docs-5.3.18-57.3 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:94178
    P
    		 (Important)
    2021-07-14
    oval:org.opensuse.security:def:66860
    P
    		Security update for ffmpeg (Important)
    2021-07-14
    oval:org.opensuse.security:def:1465
    P
    		Security update for postgresql13 (Moderate)
    2021-07-11
    oval:org.opensuse.security:def:69672
    P
    		Security update for java-1_8_0-openjdk (Moderate)
    2021-06-17
    oval:org.opensuse.security:def:66817
    P
    		Security update for pam_radius (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:73643
    P
    		Security update for qemu (Important)
    2021-06-08
    oval:org.opensuse.security:def:93741
    P
    		 (Important)
    2021-06-02
    oval:org.opensuse.security:def:66759
    P
    		Security update for samba (Important)
    2021-04-29
    oval:org.opensuse.security:def:70207
    P
    		Security update for samba (Important)
    2021-04-29
    oval:org.opensuse.security:def:70203
    P
    		Security update for sudo (Important)
    2021-04-20
    oval:org.opensuse.security:def:69777
    P
    		Security update for subversion (Important)
    2021-02-10
    oval:org.opensuse.security:def:70308
    P
    		Security update for python (Important)
    2021-02-09
    oval:org.opensuse.security:def:66851
    P
    		Security update for go1.14 (Moderate)
    2021-01-26
    oval:org.opensuse.security:def:66725
    P
    		Security update for libzypp, zypper (Moderate)
    2021-01-13
    oval:org.opensuse.security:def:70173
    P
    		Security update for openssh (Moderate)
    2020-12-18
    oval:org.opensuse.security:def:66421
    P
    		Security update for openssl-1_0_0 (Important)
    2020-12-11
    oval:org.opensuse.security:def:71515
    P
    		kernel-default-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1870
    P
    		kernel-docs-5.3.18-22.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:100454
    P
    		kernel-default-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61774
    P
    		kernel-default-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2025
    P
    		kernel-azure-5.3.18-16.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107561
    P
    		kernel-azure-5.3.18-16.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63088
    P
    		reiserfs-kmp-default-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107120
    P
    		kernel-default-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63623
    P
    		kernel-default-extra-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107705
    P
    		kernel-default-extra-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:72678
    P
    		kernel-docs-5.3.18-22.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1999
    P
    		reiserfs-kmp-default-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107517
    P
    		kernel-docs-5.3.18-22.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62959
    P
    		kernel-docs-5.3.18-22.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2534
    P
    		kernel-default-extra-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:94326
    P
    		kernel-default-extra-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63114
    P
    		kernel-azure-5.3.18-16.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107557
    P
    		reiserfs-kmp-default-5.3.18-22.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:94138
    P
    		kernel-docs-5.3.18-22.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:70068
    P
    		libQt5OpenGLExtensions-devel-static on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49852
    P
    		osc on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73508
    P
    		kernel-docs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73390
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:49841
    P
    		kernel-docs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:70102
    P
    		libmp3lame-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50179
    P
    		bogofilter-common on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73542
    P
    		kernel-azure on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49072
    P
    		cpp7 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73424
    P
    		libgypsy-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49906
    P
    		kernel-azure on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:66329
    P
    		Security update for MozillaThunderbird (Important)
    2020-12-01
    oval:org.opensuse.security:def:49787
    P
    		kernel-docs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73525
    P
    		perl-Net-Libproxy on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50233
    P
    		kernel-default-extra on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73112
    P
    		kernel-default on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:72994
    P
    		Security update for MozillaThunderbird (Important)
    2020-12-01
    oval:com.ubuntu.disco:def:2019199470000000
    V
    		CVE-2019-19947 on Ubuntu 19.04 (disco) - low.
    2019-12-24
    oval:com.ubuntu.bionic:def:2019199470000000
    V
    		CVE-2019-19947 on Ubuntu 18.04 LTS (bionic) - low.
    2019-12-24
    oval:com.ubuntu.xenial:def:2019199470000000
    V
    		CVE-2019-19947 on Ubuntu 16.04 LTS (xenial) - low.
    2019-12-24
    BACK
    linux linux kernel *
    debian debian linux 8.0
    canonical ubuntu linux 18.04
    canonical ubuntu linux 14.04
    canonical ubuntu linux 19.10
    canonical ubuntu linux 16.04
    netapp cloud backup -
    netapp steelstore cloud integrated storage -
    netapp data availability services -
    netapp solidfire & hci management node -
    netapp active iq unified manager -
    netapp solidfire baseboard management controller -
    netapp fas/aff baseboard management controller -
    netapp e-series santricity os controller *
    netapp hci baseboard management controller h610s
    netapp aff baseboard management controller a700s
    linux linux kernel 5.4.6
    ibm spectrum protect plus 10.1.0