CVE-2018-19985

What it actually does

Out-of-bounds read in the hso USB driver that indexes a small array with an attacker-controlled u8 value from a USB device, enabling arbitrary kernel memory reads.

Why it matters to the business

Physical attackers can disclose sensitive kernel memory contents on affected Linux systems, risking exposure of credentials or other confidential data; low likelihood given physical access requirement and lack of known exploitation.

How an attack unfolds

An attacker with physical access connects a malicious USB device that supplies a crafted if_num value; the hso_get_config_data function reads this value and performs an OOB array access, leaking kernel memory back to the device.

How to fix it

Upgrade the Linux kernel to a version containing the fix for this driver flaw (post-4.19.8); apply vendor patches for debian linux, netapp active iq performance analytics services, and netapp element software management node; restrict physical USB port access as a compensating control.

How to confirm the fix worked

Verify kernel source no longer contains the vulnerable hso_get_config_data indexing logic or confirm updated package versions; test with a crafted USB device in a lab environment to ensure OOB read no longer occurs.

Typical attack path

1. Prepare a USB device capable of responding with arbitrary if_num values during enumeration
2. Physically connect the device to a target system running an affected kernel
3. Trigger hso_get_config_data via device initialization to perform the OOB read
4. Exfiltrate leaked kernel memory contents through the USB interface

How to detect it

Review kernel logs for hso driver activity around USB insertion events; inspect dmesg or syslog for references to hso_get_config_data or anomalous USB configuration reads; correlate with physical access logs.

• hso_get_config_data
• drivers/net/usb/hso.c
• if_num
• hso usb device enumeration

What your security team should do

• Apply kernel updates to all affected distributions immediately
• Disable or physically secure USB ports on high-value systems
• Monitor for new exploit maturity indicators given the 2019 disclosure date