CVE-2018-19939 Null dereference in n/a
A NULL pointer dereference in the Goodix touchscreen driver allows local attackers to cause a denial of service on Xiaomi devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-19939?
CVE-2018-19939 is a high-severity vulnerability in n/a, published on 7 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Goodix GT9xx touchscreen driver for custom Linux kernels on Xiaomi daisy-o-oss and daisy-p-oss as used in Mi A2 Lite and RedMi6 pro devices through 2018-08-27 has a NULL pointer dereference in kfree after a kmalloc failure in gtp_read_Color in drivers/input/touchscreen/gt917d/gt9xx.c.
Weakness: CWE-476
Which versions are affected by CVE-2018-19939?
It affects 2 products.
Products include Mi Mi A2 Lite Firmware, Mi Redmi 6 Firmware.
How do I fix CVE-2018-19939?
No fix has been published for CVE-2018-19939 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-19939 being exploited?
There is no known exploitation of CVE-2018-19939 in the wild and no public exploit code.
Sources
Also known as GHSA-4v5p-wg3c-r4x4.