CVE-2019-19529

A use-after-free flaw was found in the driver for the USB Microchip CAN BUS Analyzer Tool. The CAN BUS analysis hardware is not commonly found on server-grade hardware where the flaw exists while a device is removed (physical access) or a kernel module is unloaded (administrative privileges). An attacker must race the code while the device is being unplugged to take advantage of this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As the mcba_usb odule will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions:

echo "install mcba_usb /bin/true" >> /etc/modprobe.d/disable-mcba_usb.conf

The system will need to be restarted in the unlikely case that the modules are loaded. In most circumstances, the kernel modules will be unable to be unloaded with rmmod while any device has the software in use.

If the system requires this module to work correctly, this mitigation may not be suitable, alternative USB can analysers will not suffer this same flaw.

If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.