CVE-2019-11884

LOW EPSS 38.7%

Published May 10, 20197y ago · Modified Jun 17, 20262w ago

3.3 CVSS 3.1

Low

Published May 10, 2019 7y ago

Last Modified Jun 17, 2026 2w ago

Description

The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character.

CVSS Details

Base Score

3.3

Exploitability

1.8

Impact

1.4

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

38.7% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Affected Products 30

Vendor	Product	Version	Range
linux	linux_kernel	*	<5.0.15
fedoraproject	fedora	28	any
fedoraproject	fedora	29	any
fedoraproject	fedora	30	any
debian	debian_linux	8.0	any
debian	debian_linux	9.0	any
canonical	ubuntu_linux	16.04	any
canonical	ubuntu_linux	18.04	any
canonical	ubuntu_linux	19.04	any
redhat	enterprise_linux	8.0	any
redhat	enterprise_linux_eus	8.1	any
redhat	enterprise_linux_eus	8.2	any
redhat	enterprise_linux_eus	8.4	any
redhat	enterprise_linux_eus	8.6	any
redhat	enterprise_linux_for_real_time	8.0	any
redhat	enterprise_linux_for_real_time_for_nfv_tus	8.2	any
redhat	enterprise_linux_for_real_time_for_nfv_tus	8.4	any
redhat	enterprise_linux_for_real_time_for_nfv_tus	8.6	any
redhat	enterprise_linux_for_real_time_tus	8.2	any
redhat	enterprise_linux_for_real_time_tus	8.4	any
redhat	enterprise_linux_for_real_time_tus	8.6	any
redhat	enterprise_linux_server_aus	8.2	any
redhat	enterprise_linux_server_aus	8.4	any
redhat	enterprise_linux_server_aus	8.6	any
redhat	enterprise_linux_server_tus	8.2	any
redhat	enterprise_linux_server_tus	8.4	any
redhat	enterprise_linux_server_tus	8.6	any
opensuse	leap	15.0	any
opensuse	leap	15.1	any
opensuse	leap	42.3	any

References 23

lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.html

Mailing ListThird Party Advisory
lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html

Mailing ListThird Party Advisory
lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html

Mailing ListThird Party Advisory
securityfocus.com http://www.securityfocus.com/bid/108299

Broken LinkThird Party AdvisoryVDB Entry
access.redhat.com https://access.redhat.com/errata/RHSA-2019:3309

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2019:3517

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2020:0740

Third Party Advisory
cdn.kernel.org https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.15

Release NotesVendor Advisory
git.kernel.org https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a1616a5ac99ede5d605047a9012481ce7ff18b16

PatchVendor Advisory
github.com https://github.com/torvalds/linux/commit/a1616a5ac99ede5d605047a9012481ce7ff18b16

PatchVendor Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2019/06/msg00010.html

Mailing ListThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html

Mailing ListThird Party Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPWHQHNM2MSGO3FDJVIQXQNKYVR7TV45/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAYXGGJUUYPOMCBZGGDCUZFLUU3JOZG5/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF2PDXUGOFEOTPVEACKFIHQB6O4XUIZD/
seclists.org https://seclists.org/bugtraq/2019/Jun/26

Mailing ListThird Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/4068-1/

Third Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/4068-2/

Third Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/4069-1/

Third Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/4069-2/

Third Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/4076-1/

Third Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/4118-1/

Third Party Advisory
debian.org https://www.debian.org/security/2019/dsa-4465

Third Party Advisory

Remediation

git.kernel.org https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a1616a5ac99ede5d605047a9012481ce7ff18b16

PatchVendor Advisory
github.com https://github.com/torvalds/linux/commit/a1616a5ac99ede5d605047a9012481ce7ff18b16

PatchVendor Advisory