Null pointer dereference in Linux kernel - CVE-2019-16232

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU92782

Null pointer dereference in Linux kernel - CVE-2019-16232

Published: September 11, 2019 / Updated: May 4, 2020


Vulnerability identifier: #VU92782
CSH Severity: Low
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16232
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged user to perform a denial of service (DoS) attack.

drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.


Affected software

Linux kernel
Slackware Linux
Ubuntu
Fedora
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-generic-lpae-lts-xenial (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-powerpc64-smp (Ubuntu package)
linux-image-powerpc64-emb (Ubuntu package)
linux-image-powerpc-smp (Ubuntu package)
linux-image-powerpc-e500mc (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-4.4.0-208-powerpc64-smp (Ubuntu package)
linux-image-4.4.0-208-powerpc64-emb (Ubuntu package)
linux-image-4.4.0-208-powerpc-smp (Ubuntu package)
linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package)
linux-image-4.4.0-208-lowlatency (Ubuntu package)
linux-image-4.4.0-208-generic-lpae (Ubuntu package)
linux-image-4.4.0-208-generic (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1090-aws (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-1091-kvm (Ubuntu package)
linux-image-4.4.0-1126-aws (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.4.0-1150-raspi2 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.4.0-1154-snapdragon (Ubuntu package)
linux-4.4.276/kernel-generic
linux-4.4.276/kernel-huge
linux-4.4.276/kernel-modules
linux-4.4.276/kernel-headers
kernel

How to mitigate CVE-2019-16232

Install update from vendor's repository.

linux-image-virtual-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-generic-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-generic-lpae-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-virtual (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc64-smp (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc64-emb (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc-smp (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc-e500mc (Ubuntu package) - update to 4.4.0.208.214
linux-image-lowlatency (Ubuntu package) - update to 4.4.0.208.214
linux-image-generic-lpae (Ubuntu package) - update to 4.4.0.208.214
linux-image-generic (Ubuntu package) - update to 4.4.0.208.214
linux-image-4.4.0-208-powerpc64-smp (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-powerpc64-emb (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-powerpc-smp (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-lowlatency (Ubuntu package) - update to 4.4.0-208.240~14.04.1
linux-image-4.4.0-208-generic-lpae (Ubuntu package) - update to 4.4.0-208.240~14.04.1
linux-image-4.4.0-208-generic (Ubuntu package) - update to 4.4.0-208.240~14.04.1
linux-image-aws (Ubuntu package) - addressed in versions 4.4.0.1090.87, 4.4.0.1126.131
linux-image-4.4.0-1090-aws (Ubuntu package) - update to 4.4.0-1090.94
linux-image-kvm (Ubuntu package) - update to 4.4.0.1091.89
linux-image-4.4.0-1091-kvm (Ubuntu package) - update to 4.4.0-1091.100
linux-image-4.4.0-1126-aws (Ubuntu package) - update to 4.4.0-1126.140
linux-image-raspi2 (Ubuntu package) - update to 4.4.0.1150.150
linux-image-4.4.0-1150-raspi2 (Ubuntu package) - update to 4.4.0-1150.161
linux-image-snapdragon (Ubuntu package) - update to 4.4.0.1154.146
linux-image-4.4.0-1154-snapdragon (Ubuntu package) - update to 4.4.0-1154.164
linux-4.4.276/kernel-generic - update to 4.4.276
linux-4.4.276/kernel-huge - update to 4.4.276
linux-4.4.276/kernel-modules - update to 4.4.276
linux-4.4.276/kernel-headers - update to 4.4.276_smp
kernel - addressed in versions 5.3.14-200.fc30, 5.3.14-300.fc31

External References

Related Security Bulletins