vulnwire
5.5med

CVE-2019-9111

The msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer overflow and OOPS be…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 57%
Public exploits
0
none known

The msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer overflow and OOPS because of missing checks of the count argument in sde_evtlog_filter_write in drivers/gpu/drm/msm/sde_dbg.c. This is exploitable for a device crash via a syscall by a crafted application on a rooted device.

Exploit prediction (EPSS)

0.82% probability of exploitation in the next 30 days, higher than 57% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD2.07.1AV:N/AC:M/Au:N/C:N/I:N/A:C

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

  • github.com /MiCode/Xiaomi_Kernel_OpenSource/issues/1001 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.