CVE-2019-9213
MEDIUMReliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation
Title source: metasploitDescription
In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.
Exploits (3)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubylocallinux
https://www.exploit-db.com/exploits/47957
exploitdb
WORKING POC
VERIFIED
by Google Security Research · textdoslinux
https://www.exploit-db.com/exploits/46502
metasploit
WORKING POC
GOOD
by Mohamed Ghannam, Jann Horn, wbowling, bcoles, nstarke · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc.rb
References (26)
... and 6 more
Scores
CVSS v3
5.5
EPSS
0.0681
EPSS Percentile
91.4%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-476
Status
published
Products (10)
canonical/ubuntu_linux
12.04
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
16.04
canonical/ubuntu_linux
18.10
debian/debian_linux
8.0
linux/linux_kernel
4.9 - 4.9.162
opensuse/leap
15.0
opensuse/leap
42.3
redhat/enterprise_linux
7.0
redhat/enterprise_linux
8.0
Published
Mar 05, 2019
Tracked Since
Feb 18, 2026