PT-2018-15175 · Goodix · Goodix Gt9Xx Touchscreen Driver

Leoaccount · Publicado 2018-12-07 · Atualizado 2022-12-09 · CVE-2018-19939

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Goodix GT9xx touchscreen driver versions prior to the version that fixes the NULL pointer dereference issue

Description The issue is related to a NULL pointer dereference in the kfree function after a kmalloc failure in the gtp read Color function, located in the gt9xx.c file. This problem affects custom Linux kernels on specific Xiaomi devices, including Mi A2 Lite and RedMi6 pro, as used through 2018-08-27.

Recommendations For the Goodix GT9xx touchscreen driver, as a temporary workaround, consider disabling the gtp read Color function in the gt9xx.c file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2018-19939

Produtos afetados

Goodix Gt9Xx Touchscreen Driver

Referências · 3

• https://github.com/MiCode/Xiaomi_Kernel_OpenSource/issues/972 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-19939 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19939 · Aviso do Fabricante