VDB
CVE-2019-12454
CVE-2019-12454
PUBLISHED
CVSS 7.800000190734863 HIGH
An issue was discovered in wcd9335_codec_enable_dec in sound/soc/codecs/wcd9335.c in the Linux kernel through 5.1.5. It uses kstrndup instead of kmemdup_nul, which allows attackers to have an unspecified impact via unknown vectors. NOTE: The vendor disputes this issues as not being a vulnerability because switching to kmemdup_nul() would only fix a security issue if the source string wasn't NUL-terminated, which is not the case
EPSS 0.44% · 36.8th percentile
Risk Scores
CVSS 3.0
7.800000190734863
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.44%
36.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:14.04:LTS | linux | 3.13.0-113.160, 3.13.0-22.44, 3.13.0-23.45 |
| Ubuntu:Pro:14.04:LTS | linux-aws | 4.4.0-1048.52, 4.4.0-1050.54, 4.4.0-1055.59 |
| Ubuntu:Pro:14.04:LTS | linux-lts-xenial | 4.4.0-272.306~14.04.1, 4.4.0-13.29~14.04.1, 4.4.0-14.30~14.04.2 |
| Ubuntu:Pro:14.04:LTS | linux-azure | 4.15.0-1023.24~14.04.1, 4.15.0-1030.31~14.04.1, 4.15.0-1032.33~14.04.2 |
Timeline
- May 30, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 1, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Jul 5, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-12454 third-party-advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git/commit/?h=for-5.3&id=a54988113985ca22e414e132054f234fc8a92604 third-party-advisory
- https://lkml.org/lkml/2019/5/29/705 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-12454 third-party-advisory