Critical NULL Pointer Dereference in Linux Kernel's Radeon Driver
Summary
DEBIAN-CVE-2019-16230: drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including various distributions of Debian. It manages hardware resources and provides essential services for software applications. The 'linux' package in Debian is crucial for system functionality, enabling communication between hardware and software. This vulnerability specifically affects the Radeon graphics driver, which is responsible for managing AMD graphics cards. The issue arises from a failure to check the return value of the alloc_workqueue function, potentially leading to system instability.
Vulnerability Detail
The vulnerability identified as CVE-2019-16230 exists in the Radeon driver of the Linux kernel version 5.2.14. It stems from the lack of validation for the return value of the alloc_workqueue function, which can result in a NULL pointer dereference. This situation may occur during the device initialization phase, particularly when the graphics card is being set up during system boot. Although the risk of an attacker exploiting this vulnerability is low, as it is not user-controllable and out-of-memory (OOM) conditions are unlikely at that time, it can still lead to system crashes or instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. However, ensuring that the system is regularly updated can help mitigate potential risks associated with unpatched vulnerabilities.
Conclusion
The CVE-2019-16230 vulnerability in the Linux kernel's Radeon driver poses a risk of system instability due to a NULL pointer dereference. Users are encouraged to update their systems to the latest version of the 'linux' package to mitigate this risk. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2019-16230 is a vulnerability in the Linux kernel's Radeon driver that can lead to a NULL pointer dereference due to a failure to check the return value of the alloc_workqueue function.
This vulnerability can cause system crashes or instability, particularly during the initialization of the graphics card at boot time.
If you are using Linux kernel version 5.2.14 or earlier, your system may be at risk. It is advisable to update to a patched version.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, ensure that your system is regularly monitored for updates and vulnerabilities to minimize risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
