CVE-2019-19074
📋 TL;DR
A memory leak vulnerability in the ath9k_wmi_cmd() function in the Linux kernel's Atheros wireless driver allows attackers to cause denial of service through memory consumption. This affects Linux systems using ath9k wireless hardware through kernel version 5.3.11. The vulnerability requires local access or ability to send crafted wireless packets to the target system.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or unavailability due to memory exhaustion, requiring physical or remote console access to reboot.
Likely Case
Degraded system performance leading to service disruption, particularly affecting wireless functionality.
If Mitigated
Minimal impact with proper memory limits and monitoring in place; system remains functional but may experience temporary performance issues.
🎯 Exploit Status
Exploitation requires ability to send crafted wireless packets or local system access; no public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.3.12 and later
Vendor Advisory: https://github.com/torvalds/linux/commit/728c1e2a05e4b5fc52fab3421dce772a806612a2
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.3.12 or later. 2. For distributions with backported patches, apply security updates. 3. Reboot system to load patched kernel.
🔧 Temporary Workarounds
Disable ath9k wireless driver
linuxPrevents exploitation by disabling the vulnerable driver module
sudo modprobe -r ath9k
echo 'blacklist ath9k' | sudo tee /etc/modprobe.d/blacklist-ath9k.conf
Use alternative wireless hardware
allReplace Atheros wireless hardware with non-vulnerable alternatives
🧯 If You Can't Patch
- Implement strict memory limits using cgroups or ulimit to contain memory consumption
- Monitor system memory usage and implement alerts for abnormal consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check kernel version and ath9k module usage: uname -r && lsmod | grep ath9kCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.3.12 or later: uname -r📡 Detection & Monitoring
Log Indicators:
- Kernel oom-killer messages in /var/log/kern.log
- Abnormal memory consumption in system logs
- Wireless interface errors
Network Indicators:
- Unusual wireless packet patterns to ath9k interfaces
SIEM Query:
source="kernel" AND ("oom-killer" OR "ath9k" OR "memory exhaustion")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
- https://github.com/torvalds/linux/commit/728c1e2a05e4b5fc52fab3421dce772a806612a2
- https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T/
- https://security.netapp.com/advisory/ntap-20191205-0001/
- https://usn.ubuntu.com/4526-1/
- https://usn.ubuntu.com/4527-1/
- https://www.oracle.com/security-alerts/cpuApr2021.html
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
- https://github.com/torvalds/linux/commit/728c1e2a05e4b5fc52fab3421dce772a806612a2
- https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T/
- https://security.netapp.com/advisory/ntap-20191205-0001/
- https://usn.ubuntu.com/4526-1/
- https://usn.ubuntu.com/4527-1/
- https://www.oracle.com/security-alerts/cpuApr2021.html
