PT-2019-19366 · Linux Foundation+2 · Linux+2

Leoaccount · Publicado 2019-02-25 · Atualizado 2019-02-26 · CVE-2019-9112

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26

Description The issue is caused by an integer overflow due to missing checks of the count argument in the sde debugfs conn cmd tx write function in drivers/gpu/drm/msm/sde/sde connector.c. This can be exploited to cause a device crash via a syscall by a crafted application on a rooted device.

Recommendations For the msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26, consider disabling the sde debugfs conn cmd tx write function in drivers/gpu/drm/msm/sde/sde connector.c to prevent exploitation until a patch is available. Restrict access to the sde connector.c module to minimize the risk of exploitation. Avoid using the count argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2019-9112

Produtos afetados

Linux

Xiaomi Perseus-P-Oss Mix 3

Msm Gpu Driver

Referências · 3

• https://github.com/MiCode/Xiaomi_Kernel_OpenSource/issues/1000 · Nota
• https://osv.dev/vulnerability/CVE-2019-9112 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9112 · Nota de Segurança