Memory Allocation Failure in Linux Kernel's EFI Subsystem - CVE-2019-12380
Summary
DEBIAN-CVE-2019-12380: DISPUTED An issue was discovered in the efi subsystem in the Linux kernel through 5.1.5. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. It is known for its robustness and versatility, supporting a wide range of devices and architectures. The EFI (Extensible Firmware Interface) subsystem is responsible for booting the operating system and managing hardware initialization. This vulnerability arises from improper handling of memory allocation failures within the EFI subsystem, potentially affecting system stability during the boot process.
Vulnerability Detail
CVE-2019-12380 is a vulnerability discovered in the efi subsystem of the Linux kernel, affecting versions up to 5.1.5. The issue lies in the functions phys_efi_set_virtual_address_map and efi_call_phys_prolog, which mishandle memory allocation failures. Although the vulnerability is disputed, as it is argued that the affected code runs only at boot time before any user processes are initiated, it raises concerns about system reliability and potential exploitation during the boot phase.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. However, users are advised to monitor their systems for any unusual behavior during the boot process and ensure that they are using the latest kernel version.
Conclusion
CVE-2019-12380 is a vulnerability in the Linux kernel's EFI subsystem that may affect system stability during the boot process. While it is classified as unimportant, it is advisable to update to a patched version of the Linux kernel to mitigate any potential risks. Users can utilize tools like Vulert to monitor their systems for vulnerabilities without needing to access the code directly.
See every vulnerability recorded for linux →
FAQ
CVE-2019-12380 is a vulnerability in the Linux kernel's EFI subsystem that involves improper handling of memory allocation failures.
The urgency of this vulnerability is classified as unimportant, but it may still affect system stability during the boot process.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities like CVE-2019-12380.
If you cannot update your kernel, ensure that your system is configured securely and monitor it for any unusual behavior during boot.
More information can be found in the official CVE database and security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
