Linux Kernel up to 5.1.5 consolemap.c con_insert_unipair resource management

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.1.5. It has been rated as problematic. Affected by this issue is the function con_insert_unipair of the file drivers/tty/vt/consolemap.c. The manipulation leads to resource management. This vulnerability is listed as CVE-2019-12379. The attack must be carried out locally. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.1.5 (Operating System) and classified as problematic. This issue affects the function con_insert_unipair of the file drivers/tty/vt/consolemap.c. The manipulation with an unknown input leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is availability. The summary by CVE is:

An issue was discovered in con_insert_unipair in drivers/tty/vt/consolemap.c in the Linux kernel through 5.1.5. There is a memory leak in a certain case of an ENOMEM outcome of kmalloc.

The weakness was presented 05/24/2019 as confirmed git commit (GIT Repository). The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2019-12379 since 05/27/2019. The exploitation is known to be easy. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The following code is the reason for this vulnerability:

if (!p2) return -ENOMEM;

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability will be addressed with the following lines of code:

if (!p2) {
	kfree(p1);
	p->uni_pgdir[n] = NULL;
	return -ENOMEM;
}

See VDB-135722, VDB-135882, VDB-135883 and VDB-136477 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion