Bugzilla – Bug 1157300
VUL-1: DISPUTED: CVE-2019-19064: kernel-source: A memory leak in the fsl_lpspi_probe() function in drivers/spi/spi-fsl-lpspi.c
Last modified: 2022-12-23 11:43:35 UTC
CVE-2019-19064 A memory leak in the fsl_lpspi_probe() function in drivers/spi/spi-fsl-lpspi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering pm_runtime_get_sync() failures, aka CID-057b8945f78f. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19064 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19064.html https://github.com/torvalds/linux/commit/057b8945f78f76d0b04eeb5c27cd9225e5e7ad86 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19064
Will backport once when the fix is merged to Linus tree. Another candidate for dispute: a once-off leak at the driver probe time for an error condition that is hard to trigger at will (the clock enablement fails at runtime resume of the given clk).
(In reply to Takashi Iwai from comment #2) > Another candidate for dispute: a once-off leak at the driver probe time for > an error condition that is hard to trigger at will (the clock enablement > fails at runtime resume of the given clk). I requested CVE rejection from Mitre.
The relevant code is found in only SLE15-SP2 branch, and the fix is backported now. Reassigned back to security team.
Closing as DISPUTED