CVE-2019-11867: Null Pointer Dereference
Published Feb 12, 2020
·Updated
Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the driver assumes has a size greater than zero bytes. To exploit this vulnerability, an attacker must send an IRP with a system buffer size of 0.
Affected Software
1 affected component
Realtek NDIS=10.1.505.2015
Event History
Feb 12, 2020
CVE Published
via MITRE·05:25 PM
Data Sourced
via MITRE·05:25 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-11867?
The severity of CVE-2019-11867 is medium with a score of 5.5.
2
What is the affected software version?
The affected software version is Realtek NDIS driver rt640x64.sys version 10.1.505.2015.
3
How does CVE-2019-11867 exploit the vulnerability?
CVE-2019-11867 exploits the vulnerability by sending an IRP with a system buffer size of 0.
4
Is there a fix available for CVE-2019-11867?
At the moment, there is no known fix available for CVE-2019-11867.
5
What is the Common Weakness Enumeration (CWE) for CVE-2019-11867?
The Common Weakness Enumeration (CWE) for CVE-2019-11867 is CWE-476.