NULL pointer dereference in Linux kernel - CVE-2019-15217
Published: August 20, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30810
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-15217
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dreference error in drivers/media/usb/zr364xx/zr364xx.c driver. A remote attacker can perform a denial of service (DoS) attack.
Affected software
Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Workstation
Slackware Linux
kernel (Red Hat package)
kernel-rt (Red Hat package)
linux-4.4.217/kernel-generic
linux-4.4.217/kernel-huge
linux-4.4.217/kernel-modules
linux-4.4.217/kernel-headers
RSA Authentication Manager
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Workstation
Slackware Linux
kernel (Red Hat package)
kernel-rt (Red Hat package)
linux-4.4.217/kernel-generic
linux-4.4.217/kernel-huge
linux-4.4.217/kernel-modules
linux-4.4.217/kernel-headers
RSA Authentication Manager
How to mitigate CVE-2019-15217
Update to version 5.2.3.
Linux kernel - update to 5.2.3
kernel (Red Hat package) - update to 3.10.0-1160.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.rt56.1131.el7
linux-4.4.217/kernel-generic - update to 4.4.217
linux-4.4.217/kernel-huge - update to 4.4.217
linux-4.4.217/kernel-modules - update to 4.4.217
linux-4.4.217/kernel-headers - update to 4.4.217_smp
RSA Authentication Manager - update to 8.4 Patch 9
kernel (Red Hat package) - update to 3.10.0-1160.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.rt56.1131.el7
linux-4.4.217/kernel-generic - update to 4.4.217
linux-4.4.217/kernel-huge - update to 4.4.217
linux-4.4.217/kernel-modules - update to 4.4.217
linux-4.4.217/kernel-headers - update to 4.4.217_smp
RSA Authentication Manager - update to 8.4 Patch 9
External References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
- http://www.openwall.com/lists/oss-security/2019/08/20/2
- http://www.openwall.com/lists/oss-security/2019/08/22/2
- http://www.openwall.com/lists/oss-security/2019/08/22/3
- http://www.openwall.com/lists/oss-security/2019/08/22/4
- http://www.openwall.com/lists/oss-security/2019/08/22/5
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d2e73a5f80a5b5aff3caf1ec6d39b5b3f54b26e
- https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html
- https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
- https://security.netapp.com/advisory/ntap-20190905-0002/
- https://syzkaller.appspot.com/bug?id=9c0c178c24d828a7378f483309001329750aad64
- https://usn.ubuntu.com/4147-1/
- https://usn.ubuntu.com/4286-1/
- https://usn.ubuntu.com/4286-2/
- https://usn.ubuntu.com/4302-1/