CVE-2019-12456

HIGH

Linux Kernel < 5.1.5 - Denial of Service via Double Fetch in MPT3COMMAND

Title source: llm
STIX 2.1

Description

An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through 5.1.5. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a "double fetch" vulnerability. NOTE: a third party reports that this is unexploitable because the doubly fetched value is not used

References (10)

Core 10
Core References
Mailing List, Third Party Advisory x_refsource_misc
https://lkml.org/lkml/2019/5/29/1164
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1717182
Vendor Advisory x_refsource_confirm
https://support.f5.com/csp/article/K84310302

Scores

CVSS v3 7.8
EPSS 0.0041
EPSS Percentile 33.4%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (1)
linux/linux_kernel < 5.1.5
Published May 30, 2019
Tracked Since Feb 18, 2026