PT-2018-15175 · Goodix · Goodix Gt9Xx Touchscreen Driver

Leoaccount · Published 2018-12-07 · Updated 2022-12-09 · CVE-2018-19939

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Goodix GT9xx touchscreen driver versions prior to the version that fixes the NULL pointer dereference issue

Description The issue is related to a NULL pointer dereference in the kfree function after a kmalloc failure in the gtp read Color function, located in the gt9xx.c file. This problem affects custom Linux kernels on specific Xiaomi devices, including Mi A2 Lite and RedMi6 pro, as used through 2018-08-27.

Recommendations For the Goodix GT9xx touchscreen driver, as a temporary workaround, consider disabling the gtp read Color function in the gt9xx.c file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2018-19939

Affected Products

Goodix Gt9Xx Touchscreen Driver

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-19939 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19939 · Vendor Advisory
• https://github.com/MiCode/Xiaomi_Kernel_OpenSource/issues/972 · Note