CVE-2019-20054: Null Pointer Dereference
A flaw was found in the Linux kernel’s implementation of dropping sysctl entries. A local attacker who has access to load modules on the system can trigger a condition during module load failure and panic the system.
Other sources
A flaw was found in the Linux kernels implementation of dropping sysctl entries. The case where insertheader() fails the parent pointer may still be set to null and then accessed.
This operation is usually invoked during a module load (a local, privileged operation) and requires a failure mode to take place. It is unlikely to be able to be used successfully as an attack vector.
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=23da9588037ecdd4901db76a5b79a42b529c4ec3 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=89189557b47b35683a27c80ee78aef18248eefb4
References:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.11 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.6
— Red Hat
In the Linux kernel before 5.0.6, there is a NULL pointer dereference in dropsysctltable() in fs/proc/procsysctl.c, related to putlinks, aka CID-23da9588037e.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-20054?
CVE-2019-20054 is a vulnerability in the Linux kernel that allows a local attacker to panic the system by triggering a condition during module load failure.
How severe is CVE-2019-20054?
CVE-2019-20054 has a severity rating of 5.1 (medium).
Which versions of the Linux kernel are affected by CVE-2019-20054?
Versions of the Linux kernel before 5.0.6 are affected by CVE-2019-20054.
How can I fix CVE-2019-20054?
To fix CVE-2019-20054, update your Linux kernel to version 5.0.6 or later.
Where can I find more information about CVE-2019-20054?
More information about CVE-2019-20054 can be found at the following references: [Reference 1], [Reference 2], [Reference 3].