CVE-2019-20054 — NULL Pointer Dereference in Kernel

CWE-476 — NULL Pointer DereferenceCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer8 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 70.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Linux KernelNetapp E-series Santricity OS Controller
Timeline
PublishedDec 28
Latest updateMay 24

Description

In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDlinux/linux_kernel< 5.0.6
▶Debianlinux/linux_kernel< 5.2.6-1+3

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-jgf2-2xcw-5gxx: In the Linux kernel before 5↗2022-05-24
▶
OSV
CVE-2019-20054: In the Linux kernel before 5↗2019-12-28
▶
CVEList
CVE-2019-20054: In the Linux kernel before 5↗2019-12-28
▶

📋Vendor Advisories

2
Red Hat
kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c↗2019-12-28
▶
Debian
CVE-2019-20054: linux - In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sy...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-20054 kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c↗2020-01-11
▶
Bugzilla
CVE-2019-20054 kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c [fedora-all]↗2020-01-11
▶
CVE-2019-20054 — NULL Pointer Dereference in Kernel | cvebase