NVD Vulnerability Detail

CVE-2019-19927

Summary	In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting a crafted f2fs filesystem image and performing some operations can lead to slab-out-of-bounds read access in ttm_put_pages in drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related to the vmwgfx or ttm module.
Publication Date	Dec. 31, 2019, 11:15 a.m.
Registration Date	Jan. 26, 2021, 11:41 a.m.
Last Update	Nov. 21, 2024, 1:35 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:linux:linux_kernel:5.0:rc7::::::

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:15.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html	Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html	Third Party Advisory
3	https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19927	Exploit Third Party Advisory
4	https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19927	Exploit Third Party Advisory
5	https://github.com/torvalds/linux/commit/453393369dc9806d2455151e329c599684762428	Patch Third Party Advisory
6	https://github.com/torvalds/linux/commit/453393369dc9806d2455151e329c599684762428	Patch Third Party Advisory
7	https://github.com/torvalds/linux/commit/a66477b0efe511d98dde3e4aaeb189790e6f0a39	Patch Third Party Advisory
8	https://github.com/torvalds/linux/commit/a66477b0efe511d98dde3e4aaeb189790e6f0a39	Patch Third Party Advisory
9	https://github.com/torvalds/linux/commit/ac1e516d5a4c56bf0cb4a3dfc0672f689131cfd4	Patch Third Party Advisory
10	https://github.com/torvalds/linux/commit/ac1e516d5a4c56bf0cb4a3dfc0672f689131cfd4	Patch Third Party Advisory
11	https://security.netapp.com/advisory/ntap-20200204-0002/	Third Party Advisory
12	https://security.netapp.com/advisory/ntap-20200204-0002/	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-125	境界外読み取り	https://cwe.mitre.org/data/definitions/125.html

JVN Vulnerability Information

Linux Kernel における境界外読み取りに関する脆弱性

Title	Linux Kernel における境界外読み取りに関する脆弱性
Summary	Linux Kernel には、境界外読み取りに関する脆弱性が存在します。
Possible impacts	情報を取得される、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 2, 2019, midnight
Registration Date	Jan. 24, 2020, 11:56 a.m.
Last Update	Jan. 24, 2020, 11:56 a.m.

Affected System

Linux

Linux Kernel 5.0.0-rc7

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-19927	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19927
National Vulnerability Database (NVD)
2	CVE-2019-19927	https://nvd.nist.gov/vuln/detail/CVE-2019-19927

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-125	https://cwe.mitre.org/data/definitions/125.html

ベンダー情報

No	Name	URL
GitHub
1	drm/ttm: fix incrementing the page pointer for huge pages	https://github.com/torvalds/linux/commit/453393369dc9806d2455151e329c599684762428
2	drm/ttm: fix out-of-bounds read in ttm_put_pages() v2	hhttps://github.com/torvalds/linux/commit/a66477b0efe511d98dde3e4aaeb189790e6f0a39
3	drm/ttm: fix start page for huge page check in ttm_put_pages()	https://github.com/torvalds/linux/commit/ac1e516d5a4c56bf0cb4a3dfc0672f689131cfd4
Linux Kernel
4	Linux Kernel Archives	http://www.kernel.org

Change Log

No	Changed Details	Date of change
1	[2020年01月24日] 掲載	Jan. 24, 2020, 11:56 a.m.