SB2019022009 - Denial of service in Linux Kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019022009

SB2019022009 - Denial of service in Linux Kernel

Published: February 20, 2019

Security Bulletin ID SB2019022009
Severity
Low
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Use-after-free (CVE-ID: CVE-2019-8912)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the af_alg_release() function, as defined in the crypto/af_alg.c source code file of the affected software, fails to set a NULL value for a certain structure member. A local attacker can access the system and execute an application that submits malicious input to the affected software and trigger a use-after-free condition in the sockfs_setattr function, resulting in a DoS condition


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References