Linux Kernel up to 5.1.5 drm_edid_load.c drm_load_edid_firmware null pointer dereference ⚔ [Disputed]

Summaryinfo

A vulnerability labeled as critical has been found in Linux Kernel up to 5.1.5. This issue affects the function drm_load_edid_firmware of the file drivers/gpu/drm/drm_edid_load.c. Such manipulation leads to null pointer dereference. This vulnerability is documented as CVE-2019-12382. The attack needs to be performed locally. There is not any exploit available. The presence of this vulnerability remains uncertain at this time. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.1.5 (Operating System). It has been rated as critical. Affected by this issue is the function drm_load_edid_firmware of the file drivers/gpu/drm/drm_edid_load.c. The manipulation with an unknown input leads to a null pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Impacted is availability. CVE summarizes:

An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).

The weakness was released 05/24/2019 (Website). The advisory is shared for download at lkml.org. This vulnerability is handled as CVE-2019-12382 since 05/27/2019. The exploitation is known to be easy. The attack needs to be approached locally. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The following code is the reason for this vulnerability:

fwstr = kstrdup(edid_firmware, GFP_KERNEL);
 	edidstr = fwstr;
 
 	while ((edidname = strsep(&edidstr, ","))) {

The real existence of this vulnerability is still doubted at the moment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 172481 (SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2019:1527-1) (Sad SACK)).

Applying a patch is able to eliminate this problem. The bugfix is ready for download at cgit.freedesktop.org. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability will be addressed with the following lines of code:

fwstr = kstrdup(edid_firmware, GFP_KERNEL);
	if (!fwstr)
		return ERR_PTR(-ENOMEM);
 	edidstr = fwstr;
 
 	while ((edidname = strsep(&edidstr, ","))) {

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 108488†). Entries connected to this vulnerability are available at VDB-10289, VDB-132474, VDB-133999 and VDB-135170. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion