Loading vulnerability…
Multiple out-of-bounds writes in Linux kernel USB HID drivers
CVE-2019-19532 comprises multiple out-of-bounds write vulnerabilities in Linux kernel HID drivers before version 5.3.9, including force-feedback and device-specific drivers. Insufficient validation of USB device metadata during attachment allows a malicious USB device to trigger kernel memory corruption. Exploitation requires physical access and can cause system crashes, incorrect-address memory reads and writes, or potentially arbitrary code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt kernel memory and crash the affected system, causing denial of service. Incorrect-address memory reads and writes can compromise confidentiality and integrity. Arbitrary code execution is a possible outcome, rather than an established consequence of every affected driver flaw.
If you can’t patch tonight, do this now.
Red Hat stated that no separate mitigation meeting its criteria for ease of use, deployment, broad applicability, and stability was available.
Patch, then assume compromise.
Install Linux kernel 5.3.9 or a distribution-supported kernel containing the backported fix associated with upstream commit d9d4b1e46d9543a82c23f6df03f4ad697dab361b. Distribution updates include Debian 8 linux-4.9 version 4.9.210-1~deb8u1, RHEL 7 kernel version 3.10.0-1160.21.1.el7 under RHSA-2021:0856, and channel-specific RHEL kernel and kernel-rt updates. Select the update appropriate to the product and support stream, then reboot into the updated kernel. Account for distribution backports rather than relying solely on the upstream version number.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.