CVE-2019-9455: Infoleak
First published: Tue Sep 03 2019(Updated: )
A flaw was found in the Linux kernel's video driver. A kernel pointer lead, due to a WARN_ON statement could lead to a local information disclosure with system execution privileges. User interaction is not needed for exploitation. The highest threat from this vulnerability is to data confidentiality.
Credit: security@android.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-240.rt7.54.el8 | 0:4.18.0-240.rt7.54.el8 |
| redhat/kernel | <0:4.18.0-240.el8 | 0:4.18.0-240.el8 |
| Android | ||
| SUSE Linux | =15.1 |
Remedy
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2019-9455 https://nvd.nist.gov/vuln/detail/CVE-2019-9455
- https://bugzilla.redhat.com/show_bug.cgi?id=1819399
- https://access.redhat.com/errata/RHSA-2020:4609
- https://access.redhat.com/errata/RHSA-2020:4431
- https://access.redhat.com/security/cve/cve-2019-9455
- https://source.android.com/security/bulletin/pixel/2019-09-01
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1819401
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html
Frequently Asked Questions
What is the severity of CVE-2019-9455?
CVE-2019-9455 has a high severity rating due to its potential impact on data confidentiality.
How do I fix CVE-2019-9455?
To resolve CVE-2019-9455, upgrade to the appropriate patched kernel version, either kernel-rt 0:4.18.0-240.rt7.54.el8 or kernel 0:4.18.0-240.el8.
What are the potential impacts of CVE-2019-9455?
CVE-2019-9455 can result in local information disclosure with system execution privileges.
Is user interaction required to exploit CVE-2019-9455?
No, CVE-2019-9455 can be exploited without any user interaction.
Which software is affected by CVE-2019-9455?
CVE-2019-9455 affects specific versions of the Linux kernel, including Red Hat kernel-rt and kernel packages, as well as Google Android and openSUSE Leap 15.1.
- collector/redhat-cve
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-9455
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/google
- canonical/android
- vendor/opensuse
- canonical/suse linux
- version/suse linux/15.1