CVE-2019-12984
published 2019-06-26CVE-2019-12984: A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered…
PriorityP421medium5.5CVSS 3.0
AVLACLPRNUIRSUCNINAH
EPSS
2.37%
82.1th percentile
A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.2.6-1 (bookworm) | linux 5.2.6-1 (bookworm) |
| linux | linux_kernel | < 5.1.13 | 5.1.13 |
| linux | linux_kernel | >= 0 < 5.2.6-1 | 5.2.6-1 |
| linux | linux_kernel | >= 0 < 5.2.6-1 | 5.2.6-1 |
| linux | linux_kernel | >= 0 < 5.2.6-1 | 5.2.6-1 |
| linux | linux_kernel | >= 0 < 5.2.6-1 | 5.2.6-1 |
| linux | linux_kernel | >= 0 < 4.15.0-58.64 | 4.15.0-58.64 |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2019-09-02·CVSS 3.3
CVE-2018-13053 [LOW] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the alarmtimer implementation in the Linux kernel
contained an integer overflow vulnerability. A local attacker could use
this to cause a denial of service. (CVE-2018-13053)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)
Wen Xu discovered that the f2fs file system implementation in the Linux
kernel did not properly validate metadata. An attacker could use this to
construct a malicious f2fs image that, when mounted, could cause a denial
of serv
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2019-09-02·CVSS 9.8
CVE-2019-10126 [CRITICAL] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a heap buffer overflow existed in the Marvell
Wireless LAN device driver for the Linux kernel. An attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2019-10126)
Amit Klein and Benny Pinkas discovered that the Linux kernel did not
sufficiently randomize IP ID values generated for connectionless networking
protocols. A remote attacker could use this to track particular Linux
devices. (CVE-2019-10638)
It was discovered that a NULL pointer dereference vulnerability existed in
the Near-field communication (NFC) implementation in the Linux kernel. A
local attacker could use this to cause a denial of service
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-08-13·CVSS 3.3
CVE-2018-13053 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the alarmtimer implementation in the Linux kernel
contained an integer overflow vulnerability. A local attacker could use
this to cause a denial of service. (CVE-2018-13053)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)
Wen Xu discovered that the f2fs file system implementation in the
Linux kernel did not properly validate metadata. An attacker could
use this to construct a malicious f2fs image that, when mounted,
could cause a denial of service (s
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-08-13·CVSS 9.8
CVE-2019-10126 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a heap buffer overflow existed in the Marvell
Wireless LAN device driver for the Linux kernel. An attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2019-10126)
Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors
incorrectly handle SWAPGS instructions during speculative execution. A
local attacker could use this to expose sensitive information (kernel
memory). (CVE-2019-1125)
It was discovered that the PowerPC dlpar implementation in the Linux kernel
did not properly check for allocation errors in some situations. A local
attacker could possibly use this to cause a denial of service (system
Red Hat
kernel: null pointer dereference in function nfc_genl_deactivate_target() in net/nfc/netlink.c
vendor_redhat·2019-06-26·CVSS 5.5
CVE-2019-12984 [MEDIUM] CWE-476 kernel: null pointer dereference in function nfc_genl_deactivate_target() in net/nfc/netlink.c
kernel: null pointer dereference in function nfc_genl_deactivate_target() in net/nfc/netlink.c
A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-alt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: k
Debian
CVE-2019-12984: linux - A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_tar...
vendor_debian·2019·CVSS 5.5
CVE-2019-12984 [MEDIUM] CVE-2019-12984: linux - A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_tar...
A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service.
Scope: local
bookworm: resolved (fixed in 5.2.6-1)
bullseye: resolved (fixed in 5.2.6-1)
forky: resolved (fixed in 5.2.6-1)
sid: resolved (fixed in 5.2.6-1)
trixie: resolved (fixed in 5.2.6-1)
GHSA
GHSA-fvcj-2mgp-5x33: A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink
ghsa_unreviewed·2022-05-24
CVE-2019-12984 [MEDIUM] CWE-476 GHSA-fvcj-2mgp-5x33: A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink
A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service.
OSV
linux-aws vulnerabilities
osv·2019-09-02·CVSS 3.3
CVE-2018-13053 [LOW] linux-aws vulnerabilities
linux-aws vulnerabilities
It was discovered that the alarmtimer implementation in the Linux kernel
contained an integer overflow vulnerability. A local attacker could use
this to cause a denial of service. (CVE-2018-13053)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)
Wen Xu discovered that the f2fs file system implementation in the Linux
kernel did not properly validate metadata. An attacker could use this to
construct a malicious f2fs image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13096, CVE-2018-13097, CVE-2018-13098,
CVE-2018-1309
OSV
linux, linux-hwe, linux-azure, linux-gcp, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-08-13·CVSS 9.8
CVE-2019-10126 [CRITICAL] linux, linux-hwe, linux-azure, linux-gcp, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-hwe, linux-azure, linux-gcp, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that a heap buffer overflow existed in the Marvell
Wireless LAN device driver for the Linux kernel. An attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2019-10126)
Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors
incorrectly handle SWAPGS instructions during speculative execution. A
local attacker could use this to expose sensitive information (kernel
memory). (CVE-2019-1125)
It was discovered that the PowerPC dlpar implementation in the Linux kernel
did not properly check for allocation errors in some situations. A local
attacker could possibly use this to cause a denial of service (system
cr
OSV
linux, linux-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-08-13·CVSS 3.3
CVE-2018-13053 [LOW] linux, linux-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the alarmtimer implementation in the Linux kernel
contained an integer overflow vulnerability. A local attacker could use
this to cause a denial of service. (CVE-2018-13053)
Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)
Wen Xu discovered that the f2fs file system implementation in the
Linux kernel did not properly validate metadata. An attacker could
use this to construct a malicious f2fs image that, when moun
OSV
CVE-2019-12984: A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink
osv·2019-06-26·CVSS 5.5
CVE-2019-12984 [MEDIUM] CVE-2019-12984: A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink
A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-12984 kernel: null pointer dereference in function nfc_genl_deactivate_target() in net/nfc/netlink.c [fedora-all]
bugzilla·2019-06-27·CVSS 5.5
CVE-2019-12984 [MEDIUM] CVE-2019-12984 kernel: null pointer dereference in function nfc_genl_deactivate_target() in net/nfc/netlink.c [fedora-all]
CVE-2019-12984 kernel: null pointer dereference in function nfc_genl_deactivate_target() in net/nfc/netlink.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: t
Bugzilla
CVE-2019-12984 kernel: null pointer dereference in function nfc_genl_deactivate_target() in net/nfc/netlink.c
bugzilla·2019-06-27·CVSS 5.5
CVE-2019-12984 [MEDIUM] CVE-2019-12984 kernel: null pointer dereference in function nfc_genl_deactivate_target() in net/nfc/netlink.c
CVE-2019-12984 kernel: null pointer dereference in function nfc_genl_deactivate_target() in net/nfc/netlink.c
A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service.
At this time no Red Hat Products ship this code enabled in a build.
Reference:
https://github.com/torvalds/linux/commit/385097a3675749cbc9e97c085c0e5dfe4269ca51
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1724638]
---
This was fixed for Fedora with the 5.1.13 stable updates.
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.re
http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.htmlhttp://www.securityfocus.com/bid/108905https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.13https://github.com/torvalds/linux/commit/385097a3675749cbc9e97c085c0e5dfe4269ca51https://seclists.org/bugtraq/2019/Aug/13https://security.netapp.com/advisory/ntap-20190806-0001/https://usn.ubuntu.com/4093-1/https://usn.ubuntu.com/4094-1/https://usn.ubuntu.com/4117-1/https://usn.ubuntu.com/4118-1/https://www.debian.org/security/2019/dsa-4495http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.htmlhttp://www.securityfocus.com/bid/108905https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.13https://github.com/torvalds/linux/commit/385097a3675749cbc9e97c085c0e5dfe4269ca51https://seclists.org/bugtraq/2019/Aug/13https://security.netapp.com/advisory/ntap-20190806-0001/https://usn.ubuntu.com/4093-1/https://usn.ubuntu.com/4094-1/https://usn.ubuntu.com/4117-1/https://usn.ubuntu.com/4118-1/https://www.debian.org/security/2019/dsa-4495
2019-06-26
Published