CVE-2019-12382

MEDIUM

Linux Kernel < 5.1.5 - Denial of Service via NULL Pointer Dereference in drm_load_edid_firmware

Title source: llm
STIX 2.1

Description

An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: The vendor disputes this issues as not being a vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance for a NULL pointer dereference

References (10)

Core 10
Core References
Mailing List, Patch, Third Party Advisory x_refsource_misc
https://lkml.org/lkml/2019/5/24/843
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/108474

Scores

CVSS v3 5.5
EPSS 0.0046
EPSS Percentile 36.5%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-476
Status published
Products (1)
linux/linux_kernel < 5.1.5
Published May 28, 2019
Tracked Since Feb 18, 2026