Denial of Service Vulnerability in Linux Kernel's DRM EDID Firmware Handling
Summary
DEBIAN-CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The kernel supports a wide range of functionalities, including device drivers, file systems, and networking. The vulnerability in question affects the Direct Rendering Manager (DRM) subsystem, specifically in the handling of Extended Display Identification Data (EDID) firmware. This issue can lead to system instability and crashes, impacting users relying on graphical interfaces.
Vulnerability Detail
An issue was discovered in the drm_load_edid_firmware function within the Linux kernel, affecting versions up to 5.1.5. The vulnerability arises from an unchecked call to kstrdup, which duplicates a string. If kstrdup returns NULL, it may lead to a NULL pointer dereference, causing a denial of service through a system crash. The vendor disputes the severity of this issue, claiming that the NULL return is handled adequately, but the potential for a crash remains a concern for users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid loading EDID firmware that may trigger this vulnerability. However, this may limit the functionality of certain display devices. It is recommended to monitor system logs for any signs of instability and to apply the kernel update as soon as possible.
Conclusion
The vulnerability in the Linux kernel's DRM EDID firmware handling poses a risk of denial of service due to potential NULL pointer dereferences. Users are advised to update their kernel to a patched version to mitigate this risk. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a denial of service, causing the system to crash when certain conditions are met.
The vulnerability affects the Linux kernel versions up to 5.1.5.
You can check your kernel version using the command 'uname -r' in the terminal.
Yes, users should update to a patched version of the Linux kernel that resolves this issue.
Vulert monitors open-source vulnerabilities in software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without signing up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
