CVE-2019-12381: Denial of Service Vulnerability in Linux Kernel
Summary
CVE-2019-12381: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a critical component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various distributions, including Debian 10, 11, 12, and 13. This vulnerability, identified as CVE-2019-12381, affects the Linux kernel versions up to 5.1.5. It involves an unchecked kmalloc of new_ra in the ip_ra_control function of the net/ipv4/ip_sockglue.c file. Although disputed, if new_ra is NULL, an attacker could exploit this vulnerability to cause a denial of service, resulting in a NULL pointer dereference and system crash.
Vulnerability Detail
The vulnerability arises from an unchecked kmalloc operation in the ip_ra_control function. If new_ra is NULL, it can lead to a NULL pointer dereference and subsequent system crash. While the usage of new_ra is disputed, the potential impact of this vulnerability is a denial of service. An attacker could exploit this vulnerability to crash the system, causing disruption and potential data loss. It is important to note that this vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux kernel is not immediately feasible, a possible workaround is to disable the affected functionality. However, this workaround should be considered temporary, as it may impact the normal operation of the system. To disable the functionality, the following steps can be taken:
- Open the terminal.
- Execute the command: <code>sudo sysctl -w net.ipv4.conf.all.accept_ra=0</code>
- Verify the changes by running: <code>sysctl net.ipv4.conf.all.accept_ra</code>
Please note that this workaround may have unintended consequences and should only be used as a temporary measure until the kernel can be updated.
Conclusion
In conclusion, CVE-2019-12381 is a denial of service vulnerability in the Linux kernel versions up to 5.1.5. It involves an unchecked kmalloc operation that can lead to a NULL pointer dereference and system crash. While disputed, if new_ra is NULL, an attacker could exploit this vulnerability to cause a denial of service. It is recommended to update the Linux kernel to version 5.1.6 or later to mitigate this vulnerability. Alternatively, a temporary workaround involves disabling the affected functionality, but this should only be used until the kernel can be updated. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The vulnerability can be exploited by an attacker to cause a denial of service, resulting in a system crash and potential data loss.
This vulnerability affects Debian 10, 11, 12, and 13, as they utilize the Linux kernel.
Yes, the Linux kernel developers have addressed this vulnerability in versions 5.1.6 and later. Updating the kernel to a patched version will mitigate the issue.
A temporary workaround involves disabling the affected functionality by modifying the net.ipv4.conf.all.accept_ra parameter. However, this should only be considered a temporary solution until the kernel can be updated.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
