CVE-2019-19082 Denial of service in n/a
Memory leaks in AMD display drivers allow attackers to cause denial of service via memory consumption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-19082?
CVE-2019-19082 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 18 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption). This affects the dce120_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, the dce100_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, and the dce112_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, aka CID-104c307147ad.
Weakness: CWE-401
Which versions are affected by CVE-2019-19082?
It affects 3 products.
Products include Canonical Ubuntu Linux, Linux kernel, Opensuse Leap.
How do I fix CVE-2019-19082?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-19082 being exploited?
There is no known exploitation of CVE-2019-19082 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2019-19082, GHSA-52px-98hx-x9g9, UBUNTU-CVE-2019-19082.