CVE-2019-16231: Null Pointer Dereference
A flaw was found in the Linux kernel. A NULL pointer dereference flaw was found in the FUJITSU Extended Socket Network driver. A call to the allocworkqueue return was not validated and causes a denial of service at the time of failure. The highest threat from this vulnerability is to system availability.
Other sources
A NULL pointer dereference flaw was found in fjesprobe in drivers/net/fjes/fjesmain.c in FUJITSU Extended Socket Network driver. Here a call to allocworkqueue return was not validated and can cause a denial of service at the time of failure. This could allow an attacker to crash the system or leak kernel internal information.
Reference: https://security.netapp.com/advisory/ntap-20191004-0001/ https://lkml.org/lkml/2019/9/9/487
— Red Hat
drivers/net/fjes/fjesmain.c in the Linux kernel 5.2.14 does not check the allocworkqueue return value, leading to a NULL pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.rt7.54.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.el8 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.2.14 - Compensating control
Apply a workaround/mitigation that prevents untrusted triggering of the FUJITSU Extended Socket Network driver path (drivers/net/fjes/fjes_main.c) to reduce the likelihood of NULL pointer dereference leading to denial of service, since no specific mitigation is provided in the material.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-16231?
CVE-2019-16231 has a high severity rating due to its potential to cause denial of service.
How do I fix CVE-2019-16231?
To fix CVE-2019-16231, update to the recommended kernel versions provided by your distribution.
What systems are affected by CVE-2019-16231?
CVE-2019-16231 affects various Linux kernel versions including those on Red Hat, Ubuntu, and openSUSE.
What exploit does CVE-2019-16231 present?
CVE-2019-16231 presents an exploit that could lead to a NULL pointer dereference in the FUJITSU Extended Socket Network driver.
Is there a patch available for CVE-2019-16231?
Yes, patches are available for CVE-2019-16231 in the form of updated kernel packages.