CVE-2019-19533
LowIn the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver, aka CID-a10feaf8c464.
CVSS 3.1 score
2.4
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness type
CWE-772CVE-2019-19533 is a Missing Release of Resource after Effective Lifetime vulnerability
What is Missing Release of Resource after Effective Lifetime?
The product does not release a resource after its effective lifetime has ended. Learn more on MITRE CWE
References
The following references provide additional information about CVE-2019-19533 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
-
Mailing List Third Party Advisory
-
Vendor Advisory
-
-
-
PatchKernel patch commithttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a10feaf8c464c3f9cfdd3a8a7ce17e1c0d498da1
Frequently asked questions
-
What is CVE-2019-19533?
CVE-2019-19533 is a Low severity Linux kernel vulnerability with a CVSS score of 2.4 out of 10 , classified as a Missing Release of Resource after Effective Lifetime flaw (CWE-772) . CVE-2019-19533 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
What is the CVSS score for CVE-2019-19533?
CVE-2019-19533 has a CVSS score of 2.4 out of 10, rated Low severity (CVSS 3.1). The vector string is
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. -
Is there a patch available for CVE-2019-19533?
No patch is currently available for CVE-2019-19533. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
-
Is CVE-2019-19533 actively exploited?
No — CVE-2019-19533 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
-
What is Missing Release of Resource after Effective Lifetime (CWE-772)?
The product does not release a resource after its effective lifetime has ended. View CWE-772 on MITRE CWE →