Denial of Service Vulnerability in Linux Kernel Packages: CVE-2019-12455
Summary
UBUNTU-CVE-2019-12455: An issue was discovered in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. Affects linux versions 3.11.0-12.19 – 3.13.0-98.145. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various platforms, including servers, desktops, and embedded systems. The vulnerability CVE-2019-12455 affects specific versions of the Linux kernel packages, particularly those in Ubuntu 14.04 LTS, which are critical for system stability and performance.
Vulnerability Detail
An issue was discovered in the sunxi_divs_clk_setup function within the Linux kernel, specifically in the file drivers/clk/sunxi/clk-sunxi.c. The vulnerability arises from an unchecked kstrndup of derived_name, which could potentially allow an attacker to trigger a denial of service (DoS) by causing a NULL pointer dereference, leading to a system crash. Although this vulnerability is disputed as not being a significant issue due to its occurrence only during boot time, it still poses a risk to system reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if immediate patching is not feasible, consider limiting access to the affected systems and monitoring for unusual behavior during boot time. Additionally, ensure that only trusted users have access to the system to mitigate potential exploitation.
Conclusion
CVE-2019-12455 is a notable vulnerability in the Linux kernel that can lead to system crashes due to unchecked memory allocation during boot. It is essential for users of affected packages to update to the patched versions to ensure system stability and security. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2019-12455 is a vulnerability in the Linux kernel that could lead to a denial of service due to an unchecked memory allocation during system boot.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary impact is a denial of service, which can cause the system to crash during boot, affecting system availability.
Yes, patched versions of the affected Linux kernel packages are available. Updating to these versions will mitigate the vulnerability.
The CVSS score of CVE-2019-12455 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
