CVE-2019-12382: Denial of Service Vulnerability in Linux Kernel
Summary
CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the core functionality for various Linux distributions. The vulnerability, identified as CVE-2019-12382, affects the Linux kernel versions up to 5.1.5. It specifically impacts the 'drm_load_edid_firmware' function in the 'drivers/gpu/drm/drm_edid_load.c' file. This vulnerability arises due to an unchecked 'kstrdup' operation on the 'fwstr' variable, potentially leading to a NULL pointer dereference and system crash.
Vulnerability Detail
The vulnerability in the 'drm_load_edid_firmware' function allows an attacker to cause a denial of service by exploiting a NULL pointer dereference. By providing malicious input, an attacker can trigger the 'kstrdup' operation to return NULL, leading to a crash in the system. The impact of this vulnerability is a system crash, resulting in a denial of service. The vendor disputes this issue as not being a vulnerability, claiming that the NULL pointer dereference is handled sufficiently. However, the potential for a crash remains.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The CVE-2019-12382 vulnerability in the Linux kernel can lead to a denial of service due to a NULL pointer dereference. It is crucial to update the Linux kernel to a patched version beyond 5.1.5 to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The impact of this vulnerability is a system crash, resulting in a denial of service.
No specific workaround has been provided for this vulnerability.
The Linux kernel is an open-source monolithic Unix-like computer operating system kernel.
The vulnerability affects Linux kernel versions up to 5.1.5.
To fix this vulnerability, it is recommended to update the Linux kernel to a version beyond 5.1.5.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
