CVSS: 5.5EPSS: 0%CPEs: 19EXPL: 0CVE-2019-20095 – kernel: memory leak in mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c
https://notcve.org/view.php?id=CVE-2019-20095
mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service. La función mwifiex_tm_cmd en el archivo drivers/net/wireless/marvell/mwifiex/cfg80211.c en el kernel de Linux versiones anteriores a la versión 5.1.6 tiene algunos casos de manejo de errores que no liberaron la memoria hostcmd asignada, también se conoce como CID-003b686ace82. Esto causará una pérdida de memoria y una denegación de servicio. A flaw was found in the Linux kernel's mwifiex driver implementation when connecting to other WiFi devices in "Test Mode." • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.6 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=003b686ace820ce2d635a83f10f2d7f9c147dabc https://security.netapp.com/advisory/ntap-20200204-0002 https://access.redhat.com/security/cve/CVE-2019-20095 https://bugzilla.redhat.com/show_bug.cgi?id=1791954 • CWE-401: Missing Release of Memory after Effective Lifetime CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 17EXPL: 0CVE-2019-20054 – kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c
https://notcve.org/view.php?id=CVE-2019-20054
In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. En el kernel de Linux versiones anteriores a la versión 5.0.6, hay una desreferencia del puntero NULL en la función drop_sysctl_table() en el archivo fs/proc/proc_sysctl.c, relacionado con put_links, también se conoce como CID-23da9588037e. A flaw was found in the Linux kernel’s implementation of dropping sysctl entries. A local attacker who has access to load modules on the system can trigger a condition during module load failure and panic the system. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.11 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.6 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=23da9588037ecdd4901db76a5b79a42b529c4ec3 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=89189557b47b35683a27c80ee78aef18248eefb4 https://security.netapp.com/advisory/ntap-20200204-0002 https&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-476: NULL Pointer Dereference •
CVSS: 4.7EPSS: 0%CPEs: 24EXPL: 1CVE-2019-19965
https://notcve.org/view.php?id=CVE-2019-19965
In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5. En el kernel de Linux versiones hasta 5.4.6, se presenta una desreferencia del puntero NULL en el archivo drivers/scsi/libsas/sas_discover.c debido a un manejo inapropiado de la desconexión del puerto durante la detección, relacionado con una condición de carrera baja PHY, también se conoce como CID-f70267f379b5. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f70267f379b5e5e11bdc5d72a56bf17e5feed01f https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html https://security.netapp.com/advisory/ntap-20200204-0002 https://usn.ubuntu.com/4284-1 https://usn.ubuntu.com/4285-1 https://usn.ubuntu.com/4286-1 https:// • CWE-476: NULL Pointer Dereference •
CVSS: 4.6EPSS: 0%CPEs: 13EXPL: 1CVE-2019-19966
https://notcve.org/view.php?id=CVE-2019-19966
In the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service, aka CID-dea37a972655. En el kernel de Linux versiones anteriores a 5.1.6, se presenta un uso de la memoria previamente liberada de la función cpia2_exit() en el archivo drivers/media/usb/cpia2/cpia2_v4l.c que causará una denegación de servicio, también se conoce como CID-dea37a972655. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.6 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dea37a97265588da604c6ba80160a287b72c7bfd https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html https://security.netapp.com/advisory/ntap-20200204-0002 • CWE-416: Use After Free •
CVSS: 4.6EPSS: 0%CPEs: 16EXPL: 0CVE-2019-19947
https://notcve.org/view.php?id=CVE-2019-19947
In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c. En el kernel de Linux versiones hasta 5.4.6, se presenta un filtrado de información de la memoria no inicializada hacia un dispositivo USB en el archivo controlador drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c, también se conoce como CID-da2311a6385c. • http://www.openwall.com/lists/oss-security/2019/12/24/1 https://github.com/torvalds/linux/commit/da2311a6385c3b499da2ed5d9be59ce331fa93e9 https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html https://security.netapp.com/advisory/ntap-20200204-0002 https://usn.ubuntu.com/4284-1 https://usn.ubuntu.com/4285-1 https://usn.ubuntu.com/4427-1 https://usn.ubuntu.com/4485-1 • CWE-908: Use of Uninitialized Resource •