UBUNTU-CVE-2019-19067
Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption) by triggering mfd_add_hotplug_devices() or pm_genpd_add_device() failures, aka CID-57be09c6e874. NOTE: third parties dispute the relevance of this because the attacker must already have privileges for module loading
02 / AFFECTED SOFTWARE
Affected packages
44 explicit affected versions
2 explicit affected versions
11 explicit affected versions
6 explicit affected versions
49 explicit affected versions
30 explicit affected versions
4 explicit affected versions
56 explicit affected versions
23 explicit affected versions
1 explicit affected versions
1 explicit affected versions
2 explicit affected versions
1 explicit affected versions
9 explicit affected versions
6 explicit affected versions
10 explicit affected versions
29 explicit affected versions
28 explicit affected versions
1 explicit affected versions
1 explicit affected versions
46 explicit affected versions
1 explicit affected versions
25 explicit affected versions
23 explicit affected versions
11 explicit affected versions
49 explicit affected versions
53 explicit affected versions
51 explicit affected versions
7 explicit affected versions
62 explicit affected versions
1 explicit affected versions
8 explicit affected versions
7 explicit affected versions
31 explicit affected versions
38 explicit affected versions
1 explicit affected versions
26 explicit affected versions
33 explicit affected versions
75 explicit affected versions
39 explicit affected versions
20 explicit affected versions
12 explicit affected versions
4 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption) by triggering mfd_add_hotplug_devices() or pm_genpd_add_device() failures, aka CID-57be09c6e874. NOTE: third parties dispute the relevance of this because the attacker must already have privileges for module loading
05 / REFERENCES
Further evidence
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.8
- https://github.com/torvalds/linux/commit/57be09c6e8747bf48704136d9e3f92bfb93f5725
- https://ubuntu.com/security/CVE-2019-19067
- https://ubuntu.com/security/notices/USN-4208-1
- https://ubuntu.com/security/notices/USN-4226-1
- https://ubuntu.com/security/notices/USN-4526-1
- https://www.cve.org/CVERecord?id=CVE-2019-19067