SECUFOCUSNOW
Home›CVE index›CVE-2019-25162
Review reviewHigh

CVE-2019-25162

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment to the code, added Fixes tag]

CVSS
7.8
EPSS
0.38%
30.5% percentile
CISA KEV
Not listed
Published
2024.02.27
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.38%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment to the code, added Fixes tag]

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 < e6412ba3b6508bdf9c074d310bf4144afa6aec1a, >= 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 < 23a191b132cd87f746c62f3dc27da33683d85829, >= 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 < 871a1e94929a27bf6e2cd99523865c840bbc2d87, >= 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 < 81cb31756888bb062e92d2dca21cd629d77a46a9, >= 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 < 35927d7509ab9bf41896b7e44f639504eae08af7, >= 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 < e8e1a046cf87c8b1363e5de835114f2779e2aaf4, >= 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 < 12b0606000d0828630c033bf0c74c748464fe87d, >= 611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6 < e4c72c06c367758a14f227c847f9d623f1994ecf, >= 4.3, >= 4.3.0 < 4.14.291, >= 4.15.0 < 4.19.256, >= 4.20.0 < 5.4.211, >= 5.5.0 < 5.10.137, >= 5.11.0 < 5.15.61, >= 5.16.0 < 5.18.18, >= 5.19.0 < 5.19.2
Fixed versions
4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, 5.19.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416
CVE-2019-25162 — Linux Linux, linux kernel | SECUFOCUS NOW