CVE-2019-10207: Null Pointer Dereference
A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.
Other sources
A flaw was found in the Linux kernel’s Bluetooth implementation of UART. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.
A flaw was found in the Linux kernels bluetooth implementation of UART. A local attacker with write permissions to the bluetooth device can cause a system crash by issuing a specially crafted ioctl function call.
Terminal control operations set on this device node will end up attempting to jump to the null (0x0) page for instruction execution. The kernel code can attempt to execute code in a worker-thread context which does not have the null page mapped.
At this time it is understood to be a local denial of service and no privilege escalation is available.
Upstream submission: https://lore.kernel.org/linux-bluetooth/20190725120909.31235-1-vdronov@redhat.com/T/#u
Oss-security discussion: https://www.openwall.com/lists/oss-security/2019/07/25/1
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in the hciuartsetflowcontrol function. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-10207?
CVE-2019-10207 is classified as a high severity vulnerability in the Linux kernel's Bluetooth implementation.
How do I fix CVE-2019-10207?
To fix CVE-2019-10207, upgrade to kernel versions 4.18.0 or later, or to specific patched versions provided by your Linux distribution.
What kind of access is required to exploit CVE-2019-10207?
An attacker needs local access and write permissions to the Bluetooth hardware to exploit CVE-2019-10207.
Which Linux kernel versions are affected by CVE-2019-10207?
CVE-2019-10207 affects all Linux kernel versions from 3.x.x before 4.18.0 and 5.x.x up to 5.4.
Is CVE-2019-10207 specific to any distribution?
While CVE-2019-10207 affects the general Linux kernel, specific distributions like Red Hat and Debian have their own patched releases available.