NetSight
IP …
medium5.5Public exploit code

CVE-2019-9213

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit ke…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.9 before 4.9.162
from 4.14 before 4.14.105
from 4.19 before 4.19.27
from 4.20 before 4.20.14
DebianDebian Linux
Version 8.0
RedhatEnterprise Linux
Versions 7.0, 8.0
OpensuseLeap
Versions 15.0, 42.3
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.10

Weakness classification

CWE-476

References