Skip to content
Fencer Intel
medium 5.5

CVE-2019-0161 json

Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.

published 7y ago modified 4mo ago also EUVD-2019-0968

cvss
5.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.

Patch / fix

  • edk2 Debian 14, Debian 13, Debian 12 0~20180803.dd4cae4d-1

debian advisories DEBIAN-CVE-2019-0161

  • edk2 Ubuntu Pro 16.04 LTS 0~20160408.ffea0a2c-2ubuntu0.2+esm3
  • edk2 Ubuntu Pro 18.04 LTS 0~20180205.c0d9813c-2ubuntu0.3+esm2

ubuntu advisories UBUNTU-CVE-2019-0161

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • edk2 RHEL 8 20190308git89910a39dcfd-6.el8
  • edk2-ovmf RHEL 8 20190308git89910a39dcfd-6.el8
  • edk2-aarch64 RHEL 8 20190308git89910a39dcfd-6.el8
  • ovmf RHEL 7 20180508-6.gitee3198e672e2.el7
  • OVMF RHEL 7 20180508-6.gitee3198e672e2.el7
  • imgbased RHEL 7 1.1.9-0.1.el7ev
  • ovirt-node-ng RHEL 7 4.3.5-0.20190717.0.el7ev
  • python-imgbased RHEL 7 1.1.9-0.1.el7ev

red hat advisories RHSA-2019:3338RHSA-2019:2125RHSA-2019:2437

  • ovmf SLES for SAP 12 SP3, SLES 12 SP3 2017+git1492060560.b6d11d7c46-4.26.1
  • ovmf SLES for SAP 12 SP4, SLES 12 SP4, SLED 12 SP4 2017+git1510945757.b2662641d5-3.16.1
  • ovmf SLE Module for Server Applications 15 2017+git1510945757.b2662641d5-5.22.1

suse advisories SUSE-SU-2019:1204-1SUSE-SU-2019:1157-1SUSE-SU-2019:1110-1

  • ovmf openSUSE Tumbleweed 202105-3.4
  • ovmf openSUSE Leap 15.0 2017+git1510945757.b2662641d5-lp150.4.19.1

opensuse advisories openSUSE-SU-2024:11134-1openSUSE-SU-2019:1352-1

Is CVE-2019-0161 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-0161 updated cvss 5.9

edk2: stack overflow in XHCI causing denial of service

  • Red Hat Enterprise Linux AppStream (v. 8) edk2 20190308git89910a39dcfd-6.el8, edk2-ovmf 20190308git89910a39dcfd-6.el8, edk2-aarch64 20190308git89910a39dcfd-6.el8
    fixed: vendor fix RHSA-2019:3338
  • Red Hat Enterprise Linux Server (v. 7) ovmf 20180508-6.gitee3198e672e2.el7, OVMF 20180508-6.gitee3198e672e2.el7
    fixed: vendor fix RHSA-2019:2125
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.3.5-20190722.0.el7_7, redhat-virtualization-host-image-update 4.3.5-20190722.0.el7_7 Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased 1.1.9-0.1.el7ev, python-imgbased 1.1.9-0.1.el7ev, ovirt-node-ng 4.3.5-0.20190717.0.el7ev, ovirt-node-ng-nodectl 4.3.5-0.20190717.0.el7ev, redhat-release-virtualization-host 4.3.5-2.el7ev, python2-ovirt-node-ng-nodectl 4.3.5-0.20190717.0.el7ev, +1 more
    fixed: vendor fix RHSA-2019:2437

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Extensible Firmware Interface Development Kit (EDK II) Extensible Firmware Interface Development Kit (EDK II)

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.