CVE-2019-16229 — MEDIUM (4.1)

Vulnerability Description

drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: The security community disputes this issues as not being serious enough to be deserving a CVE id

CVSS Score

4.1

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Linux	Linux Kernel	5.2.14
Canonical	Ubuntu Linux	14.04
Redhat	Enterprise Linux	7.0

Related Weaknesses (CWE)

CWE-476

References

https://bugzilla.suse.com/show_bug.cgi?id=1150469#c3Issue TrackingThird Party Advisory
https://lkml.org/lkml/2019/9/9/487PatchThird Party Advisory
https://security.netapp.com/advisory/ntap-20191004-0001/Third Party Advisory
https://usn.ubuntu.com/4284-1/Third Party Advisory
https://usn.ubuntu.com/4285-1/Third Party Advisory
https://usn.ubuntu.com/4287-1/Third Party Advisory
https://usn.ubuntu.com/4287-2/Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1150469#c3Issue TrackingThird Party Advisory
https://lkml.org/lkml/2019/9/9/487PatchThird Party Advisory
https://security.netapp.com/advisory/ntap-20191004-0001/Third Party Advisory
https://usn.ubuntu.com/4284-1/Third Party Advisory
https://usn.ubuntu.com/4285-1/Third Party Advisory
https://usn.ubuntu.com/4287-1/Third Party Advisory
https://usn.ubuntu.com/4287-2/Third Party Advisory

FAQ

What is CVE-2019-16229?

CVE-2019-16229 is a vulnerability with a CVSS score of 4.1 (MEDIUM). drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: The security community disputes this...

How severe is CVE-2019-16229?

CVE-2019-16229 has been rated MEDIUM with a CVSS base score of 4.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-16229?

Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Canonical Ubuntu Linux, Redhat Enterprise Linux.