CVE-2019-19965

Опубликовано: 25 дек. 2019

Источник: nvd

CVSS3: 4.7

CVSS2: 1.9

EPSS Низкий

Описание

In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
Mailing List
Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f70267f379b5e5e11bdc5d72a56bf17e5feed01f
Exploit
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200204-0002/
Third Party Advisory
https://usn.ubuntu.com/4284-1/
Third Party Advisory
https://usn.ubuntu.com/4285-1/
Third Party Advisory
https://usn.ubuntu.com/4286-1/
Third Party Advisory
https://usn.ubuntu.com/4286-2/
Third Party Advisory
https://usn.ubuntu.com/4287-1/
Third Party Advisory
https://usn.ubuntu.com/4287-2/
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
Mailing List
Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f70267f379b5e5e11bdc5d72a56bf17e5feed01f
Exploit
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200204-0002/
Third Party Advisory
https://usn.ubuntu.com/4284-1/
Third Party Advisory
https://usn.ubuntu.com/4285-1/
Third Party Advisory
https://usn.ubuntu.com/4286-1/
Third Party Advisory
https://usn.ubuntu.com/4286-2/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия до 5.4.6 (включая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*

Версия от 11.0.0 (включая) до 11.70.1 (включая)

cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:8300:-:*:*:*:*:*:*:*

Конфигурация 9

Одновременно

cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:8700:-:*:*:*:*:*:*:*

Конфигурация 10

Одновременно

cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:a400:-:*:*:*:*:*:*:*

EPSS

Процентиль: 25%

0.0008

Низкий

4.7 Medium

CVSS3

1.9 Low

CVSS2

Дефекты

CWE-476

Связанные уязвимости

CVE-2019-19965

CVSS3: 4.7

ubuntu

больше 5 лет назад

CVE-2019-19965

CVSS3: 4.7

redhat

больше 5 лет назад

CVE-2019-19965

CVSS3: 4.7

debian

больше 5 лет назад

In the Linux kernel through 5.4.6, there is a NULL pointer dereference ...

GHSA-fg2v-2x5h-36qc

CVSS3: 4.7

github

около 3 лет назад

BDU:2020-00350

CVSS3: 4.7

fstec

больше 5 лет назад

Уязвимость компонента drivers/scsi/libsas/sas_discover.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 25%

0.0008

Низкий

4.7 Medium

CVSS3

1.9 Low

CVSS2

Дефекты

CWE-476