Lucene search

K
ubuntucveUbuntu.comUB:CVE-2019-12455
HistoryMay 30, 2019 - 12:00 a.m.

CVE-2019-12455

2019-05-3000:00:00
ubuntu.com
ubuntu.com
9

0.0004 Low

EPSS

Percentile

5.2%

DISPUTED An issue was discovered in sunxi_divs_clk_setup in
drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. There is
an unchecked kstrndup of derived_name, which might allow an attacker to
cause a denial of service (NULL pointer dereference and system crash).
NOTE: This id is disputed as not being an issue because β€œThe memory
allocation that was not checked is part of a code that only runs at boot
time, before user processes are started. Therefore, there is no possibility
for an unprivileged user to control it, and no denial of service.”.

Notes

Author Note
tyhicks This issue has a questionable security impact. The memory allocation is in the module init path and it isn’t clear if it is actually vulnerable to an attacker. This issue only affects kernels built with CONFIG_CLK_SUNXI_CLOCKS enabled. Ubuntu does not enable that config option in any kernels.

0.0004 Low

EPSS

Percentile

5.2%