CVE-2019-20806: Null Pointer Dereference
An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864handleframe() in drivers/media/pci/tw5864/tw5864-video.c, which may cause denial of service, aka CID-2e7682ebfc75.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running a Linux kernel version before 5.2 are in scope. Exploitation requires local access and high privileges, so it is primarily relevant where highly privileged local users or processes can interact with the affected kernel component.
What is the impact if the flaw is exploited?
The NULL pointer dereference in tw5864_handle_frame() may cause a denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact, but high availability impact.
What access does an attacker need?
The CVSS vector specifies local attack vector, low attack complexity, high privileges required, and no user interaction. A remote unauthenticated attacker is not described by the provided data.
Which kernel versions are affected?
The issue affects Linux kernel versions before 5.2. The referenced fix is commit 2e7682ebfc750177a4944eeb56e97a3f05734528.