CVE-2019-16231: Null Pointer Dereference
A flaw was found in the Linux kernel. A NULL pointer dereference flaw was found in the FUJITSU Extended Socket Network driver. A call to the allocworkqueue return was not validated and causes a denial of service at the time of failure. The highest threat from this vulnerability is to system availability.
Other sources
A NULL pointer dereference flaw was found in fjesprobe in drivers/net/fjes/fjesmain.c in FUJITSU Extended Socket Network driver. Here a call to allocworkqueue return was not validated and can cause a denial of service at the time of failure. This could allow an attacker to crash the system or leak kernel internal information.
Reference: https://security.netapp.com/advisory/ntap-20191004-0001/ https://lkml.org/lkml/2019/9/9/487
— Red Hat
drivers/net/fjes/fjesmain.c in the Linux kernel 5.2.14 does not check the allocworkqueue return value, leading to a NULL pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.rt7.54.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.el8 - Upgrade
Upgrade
Linux kernel (drivers/net/fjes/fjes_main.c)to a version that resolves this vulnerability.Fixed in 5.2.14 - Compensating control
Apply a compensating control to protect system availability (the highest threat per advisory), since mitigation options are not available: for example, restrict/limit network access to systems using the FUJITSU Extended Socket Network (fjes) driver to reduce the likelihood of triggering the NULL pointer dereference denial-of-service condition.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-16231?
CVE-2019-16231 has a high severity rating due to its potential to cause denial of service.
How do I fix CVE-2019-16231?
To fix CVE-2019-16231, update to the recommended kernel versions provided by your distribution.
What systems are affected by CVE-2019-16231?
CVE-2019-16231 affects various Linux kernel versions including those on Red Hat, Ubuntu, and openSUSE.
What exploit does CVE-2019-16231 present?
CVE-2019-16231 presents an exploit that could lead to a NULL pointer dereference in the FUJITSU Extended Socket Network driver.
Is there a patch available for CVE-2019-16231?
Yes, patches are available for CVE-2019-16231 in the form of updated kernel packages.