Null pointer dereference in Linux kernel - CVE-2019-19462

Vulnerability identifier: #VU92776

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19462

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.

Linux kernel
Anolis OS
Ubuntu
linux-image-4.15.0-107-lowlatency (Ubuntu package)
linux-image-4.15.0-107-generic-lpae (Ubuntu package)
linux-image-4.15.0-107-generic (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-4.15.0-109-generic (Ubuntu package)
linux-image-4.15.0-109-lowlatency (Ubuntu package)
linux-image-4.15.0-109-generic-lpae (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1046-oracle (Ubuntu package)
linux-image-4.15.0-1048-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-4.15.0-1064-gke (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.15.0-1065-raspi2 (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1069-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-4.15.0-1074-aws (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1077-aws (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-4.15.0-1078-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1081-snapdragon (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-4.15.0-1091-oem (Ubuntu package)
linux-image-4.15.0-1091-azure (Ubuntu package)
kernel-devel
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-devel
kernel-debug-core
kernel-debug
kernel-core
perf
kernel
kernel-modules
python3-perf
bpftool
kernel-tools-libs-devel
kernel-tools-libs
kernel-tools
kernel-modules-extra
kernel-headers
python-perf

Install update from vendor's repository.

linux-image-4.15.0-107-lowlatency (Ubuntu package) - update to 4.15.0-107.108~16.04.1
linux-image-4.15.0-107-generic-lpae (Ubuntu package) - update to 4.15.0-107.108~16.04.1
linux-image-4.15.0-107-generic (Ubuntu package) - update to 4.15.0-107.108~16.04.1
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.107.112
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.107.112
linux-image-generic-lpae-hwe-16.04 (Ubuntu package) - update to 4.15.0.107.112
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.107.112
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.107.112, 4.15.0.1091.94
linux-image-virtual (Ubuntu package) - update to 4.15.0.109.97
linux-image-lowlatency (Ubuntu package) - update to 4.15.0.109.97
linux-image-generic-lpae (Ubuntu package) - update to 4.15.0.109.97
linux-image-generic (Ubuntu package) - update to 4.15.0.109.97
linux-image-4.15.0-109-generic (Ubuntu package) - update to 4.15.0-109.110
linux-image-4.15.0-109-lowlatency (Ubuntu package) - update to 4.15.0-109.110
linux-image-4.15.0-109-generic-lpae (Ubuntu package) - update to 4.15.0-109.110
linux-image-oracle (Ubuntu package) - update to 4.15.0.1046.39
linux-image-4.15.0-1046-oracle (Ubuntu package) - update to 4.15.0-1046.50~16.04.1
linux-image-4.15.0-1048-oracle (Ubuntu package) - update to 4.15.0-1048.52
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1048.57
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1064.66
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1064.66, 4.15.0.1078.80
linux-image-4.15.0-1064-gke (Ubuntu package) - update to 4.15.0-1064.67
linux-image-raspi2 (Ubuntu package) - update to 4.15.0.1065.63
linux-image-4.15.0-1065-raspi2 (Ubuntu package) - update to 4.15.0-1065.69
linux-image-kvm (Ubuntu package) - update to 4.15.0.1069.65
linux-image-4.15.0-1069-kvm (Ubuntu package) - update to 4.15.0-1069.70
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1074.74
linux-image-4.15.0-1074-aws (Ubuntu package) - update to 4.15.0-1074.78~16.04.1
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1077.79
linux-image-4.15.0-1077-aws (Ubuntu package) - update to 4.15.0-1077.81
linux-image-gcp (Ubuntu package) - update to 4.15.0.1078.80
linux-image-4.15.0-1078-gcp (Ubuntu package) - addressed in versions 4.15.0-1078.88, 4.15.0-1078.88~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1078.94
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1081.84
linux-image-4.15.0-1081-snapdragon (Ubuntu package) - update to 4.15.0-1081.88
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1091.62
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1091.68, 4.15.0.1091.86
linux-image-4.15.0-1091-oem (Ubuntu package) - update to 4.15.0-1091.101
linux-image-4.15.0-1091-azure (Ubuntu package) - addressed in versions 4.15.0-1091.101, 4.15.0-1091.101~14.04.1, 4.15.0-1091.101~16.04.1
kernel-devel - addressed in versions 4.19.91-23.4, 4.19.91-26
kernel-debug-modules-extra - update to 4.19.91-23.4
kernel-debug-modules - update to 4.19.91-23.4
kernel-debug-devel - addressed in versions 4.19.91-23.4, 4.19.91-26
kernel-debug-core - update to 4.19.91-23.4
kernel-debug - addressed in versions 4.19.91-23.4, 4.19.91-26
kernel-core - update to 4.19.91-23.4
perf - addressed in versions 4.19.91-23.4, 4.19.91-26
kernel - addressed in versions 4.19.91-23.4, 4.19.91-26
kernel-modules - update to 4.19.91-23.4
python3-perf - update to 4.19.91-23.4
bpftool - addressed in versions 4.19.91-23.4, 4.19.91-26
kernel-tools-libs-devel - addressed in versions 4.19.91-23.4, 4.19.91-26
kernel-tools-libs - addressed in versions 4.19.91-23.4, 4.19.91-26
kernel-tools - addressed in versions 4.19.91-23.4, 4.19.91-26
kernel-modules-extra - update to 4.19.91-23.4
kernel-headers - addressed in versions 4.19.91-23.4, 4.19.91-26
python-perf - update to 4.19.91-26

• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html
• https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html
• https://lore.kernel.org/lkml/20191129013745.7168-1-dja@axtens.net/
• https://security.netapp.com/advisory/ntap-20210129-0004/
• https://syzkaller.appspot.com/bug?id=e4265490d26d6c01cd9bc79dc915ef0a1bf15046
• https://syzkaller.appspot.com/bug?id=f4d1cb4330bd3ddf4a628332b4285407b2eedd7b
• https://syzkaller-ppc64.appspot.com/bug?id=1c09906c83a8ea811a9e318c2a4f8e243becc6f8
• https://syzkaller-ppc64.appspot.com/bug?id=b05b4d005191cc375cdf848c3d4d980308d50531
• https://usn.ubuntu.com/4414-1/
• https://usn.ubuntu.com/4425-1/
• https://usn.ubuntu.com/4439-1/
• https://usn.ubuntu.com/4440-1/
• https://www.debian.org/security/2020/dsa-4698
• https://www.debian.org/security/2020/dsa-4699

• Null pointer dereference in Linux kernel
• Anolis OS update for kernel(ANCK)4.19
• Anolis OS update for kernel(ANCK)4.19
• Ubuntu update for linux