Vulnerability Name:

CVE-2019-12067 (CCN-202960)

Assigned:2019-08-14
Published:2019-08-14
Updated:2022-05-13
Summary:The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null.
CVSS v3 Severity:6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
3.2 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L)
2.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
1.2 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-476
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2019-12067

Source: CCN
Type: Bugzilla – Bug 1145642
(CVE-2019-12067) VUL-1: CVE-2019-12067: kvm,qemu: ide: ahci: add check to avoid null dereference

Source: MISC
Type: Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1145642

Source: XF
Type: UNKNOWN
qemu-cve201912067-dos(202960)

Source: MISC
Type: Mailing List, Patch, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01358.html

Source: MISC
Type: Mailing List, Patch, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01487.html

Source: MISC
Type: Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2019-12067

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210727-0001/

Source: CCN
Type: QEMU
QEMU

Vulnerable Configuration:Configuration 1:
  • cpe:/a:qemu:qemu:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:11.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:fedoraproject:fedora:30:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*
  • OR cpe:/a:redhat:openstack_platform:10.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:openstack_platform:14.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:qemu:qemu:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201912067
    V
    		CVE-2019-12067
    2023-04-22
    oval:org.opensuse.security:def:42419
    P
    		Security update for gpg2 (Important)
    2022-07-25
    oval:org.opensuse.security:def:42179
    P
    		Security update for glib2 (Low)
    2022-04-28
    oval:org.opensuse.security:def:42355
    P
    		Security update for the Linux Kernel (Important)
    2022-01-14
    oval:org.opensuse.security:def:35294
    P
    		Security update for the Linux Kernel (Important)
    2022-01-13
    oval:org.opensuse.security:def:34680
    P
    		Security update for openexr (Important)
    2022-01-12
    oval:org.opensuse.security:def:20320
    P
    		Security update for the Linux Kernel (Live Patch 21 for SLE 12 SP4) (Important)
    2021-12-14
    oval:org.opensuse.security:def:31318
    P
    		Security update for mozilla-nss (Important)
    2021-12-06
    oval:org.opensuse.security:def:30279
    P
    		Security update for mozilla-nss (Important)
    2021-12-06
    oval:org.opensuse.security:def:56099
    P
    		Security update for clamav (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:31705
    P
    		Security update for postgresql, postgresql13, postgresql14 (Important)
    2021-11-20
    oval:org.opensuse.security:def:34590
    P
    		Security update for MozillaFirefox (Important)
    2021-11-17
    oval:org.opensuse.security:def:57519
    P
    		Security update for postgresql10 (Important)
    2021-10-20
    oval:org.opensuse.security:def:56077
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:56076
    P
    		Security update for glibc (Moderate)
    2021-10-06
    oval:org.opensuse.security:def:31682
    P
    		Security update for openssl (Low)
    2021-09-20
    oval:org.opensuse.security:def:34533
    P
    		Security update for openssl-1_1 (Low)
    2021-09-09
    oval:org.opensuse.security:def:31261
    P
    		Security update for bind (Moderate)
    2021-08-30
    oval:org.opensuse.security:def:31666
    P
    		Security update for MozillaFirefox (Important)
    2021-08-17
    oval:org.opensuse.security:def:57481
    P
    		Security update for the Linux Kernel (Important)
    2021-07-22
    oval:org.opensuse.security:def:31644
    P
    		Security update for xterm (Important)
    2021-06-18
    oval:org.opensuse.security:def:20447
    P
    		Security update for the Linux Kernel (Important)
    2021-06-09
    oval:org.opensuse.security:def:15728
    P
    		coolkey-devel-1.1.0-147.71 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15435
    P
    		libsystemd0-228-117.12 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42545
    P
    		gnome-screensaver-2.28.3-0.39.17 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15443
    P
    		libusbmuxd4-1.0.10-2.3 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:16491
    P
    		libarchive-devel-3.1.2-25.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36458
    P
    		libksba-devel-1.0.4-1.18.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15634
    P
    		libjson-c-devel-0.11-2.22 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42516
    P
    		dbus-1-1.2.10-3.31.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:16468
    P
    		libQt5WebKit-private-headers-devel-5.6.2-1.31 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15610
    P
    		libasm-devel-0.158-3.200 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15830
    P
    		libpcp-devel-3.6.10-4.124 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15590
    P
    		libHX-devel-3.18-1.19 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15814
    P
    		libjasper-devel-1.900.1-170.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15539
    P
    		yast2-users-3.1.57-16.7 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15755
    P
    		glibc-devel-static-2.19-31.9 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15803
    P
    		libgcrypt-devel-1.6.1-16.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42596
    P
    		libgdiplus0-2.6.7-0.5.76 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:15469
    P
    		pam-modules-12.1-23.6 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36500
    P
    		libvorbis-devel-1.2.0-79.20.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:30205
    P
    		Security update for gstreamer-plugins-bad (Important)
    2021-06-07
    oval:org.opensuse.security:def:30193
    P
    		Security update for avahi (Important)
    2021-06-03
    oval:org.opensuse.security:def:42077
    P
    		Security update for curl (Moderate)
    2021-05-26
    oval:org.opensuse.security:def:34435
    P
    		Security update for libxml2 (Important)
    2021-05-19
    oval:org.opensuse.security:def:30194
    P
    		Security update for the Linux Kernel (Important)
    2021-05-17
    oval:org.opensuse.security:def:31169
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:31617
    P
    		Security update for samba (Important)
    2021-05-04
    oval:org.opensuse.security:def:20423
    P
    		Security update for the Linux Kernel (Live Patch 8 for SLE 12 SP5) (Important)
    2021-04-28
    oval:org.opensuse.security:def:20411
    P
    		Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP5) (Important)
    2021-04-07
    oval:org.opensuse.security:def:58098
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-03-17
    oval:org.opensuse.security:def:31727
    P
    		Security update for wpa_supplicant (Important)
    2021-02-15
    oval:org.opensuse.security:def:56922
    P
    		Security update for clamav (Important)
    2020-12-22
    oval:org.opensuse.security:def:31561
    P
    		Security update for postgresql12 (Important)
    2020-12-04
    oval:org.opensuse.security:def:35820
    P
    		ruby-1.8.7.p357-0.7.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:42471
    P
    		xorg-x11-server-dmx-7.3.99-17.11.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35776
    P
    		libxslt-1.1.24-19.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35660
    P
    		NetworkManager-gnome-0.7.1-5.22.28 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35734
    P
    		ldapsmb-1.34b-12.18.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35748
    P
    		libgnomesu-1.0.0-307.10.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35601
    P
    		libsamplerate-0.1.4-1.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35693
    P
    		evolution-data-server-2.28.2-0.26.33.14 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35709
    P
    		gmime-2.2.23-1.50.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:42008
    P
    		libsamplerate-0.1.4-1.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:30500
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:39849
    P
    		Security update for libvpx (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27823
    P
    		Security update for libwmf (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:20078
    P
    		Security update for net-snmp (Important)
    2020-12-01
    oval:org.opensuse.security:def:35441
    P
    		Security update for orca (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28544
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:32409
    P
    		Security update for wget (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:39154
    P
    		colord on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56756
    P
    		Security update for cairo (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30903
    P
    		Security update for fontconfig (Low)
    2020-12-01
    oval:org.opensuse.security:def:35055
    P
    		Security update for java-1_6_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:27898
    P
    		Security update for wireshark
    2020-12-01
    oval:org.opensuse.security:def:20353
    P
    		Security update for openslp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:39702
    P
    		Security update for git (Important)
    2020-12-01
    oval:org.opensuse.security:def:30962
    P
    		Security update for gpg2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34962
    P
    		Security update for freetype2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:41899
    P
    		Security update for socat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28403
    P
    		Security update for spice (Important)
    2020-12-01
    oval:org.opensuse.security:def:39058
    P
    		python-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30411
    P
    		Security update for xorg-x11-libX11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:39810
    P
    		Security update for libxslt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57600
    P
    		Security update for libksba (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27822
    P
    		Security update for LibVNCServer (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:19992
    P
    		Security update for the Linux Kernel (Live Patch 31 for SLE 12) (Important)
    2020-12-01
    oval:org.opensuse.security:def:35351
    P
    		Security update for mysql (Important)
    2020-12-01
    oval:org.opensuse.security:def:31771
    P
    		Security update for MozillaFirefox, MozillaFirefox-branding-SLED, firefox-gcc5, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:39070
    P
    		bluez-cups on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56650
    P
    		Security update for wireshark (Important)
    2020-12-01
    oval:org.opensuse.security:def:30854
    P
    		Security update for dnsmasq (Important)
    2020-12-01
    oval:org.opensuse.security:def:35011
    P
    		Security update for GPG2
    2020-12-01
    oval:org.opensuse.security:def:40602
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:27834
    P
    		Security update for mono-core (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29278
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:39542
    P
    		Security update for nodejs10 (Critical)
    2020-12-01
    oval:org.opensuse.security:def:30942
    P
    		Security update for glibc (Important)
    2020-12-01
    oval:org.opensuse.security:def:19949
    P
    		Security update for Linux Kernel Live Patch 19 for SLE 12 (Important)
    2020-12-01
    oval:org.opensuse.security:def:41747
    P
    		Security update for binutils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28251
    P
    		Security update for libxml2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34897
    P
    		Security update for dbus-1
    2020-12-01
    oval:org.opensuse.security:def:19957
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:21111
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:39059
    P
    		raptor on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56477
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30799
    P
    		Security update for bsdtar (Important)
    2020-12-01
    oval:org.opensuse.security:def:34985
    P
    		Recommended update for ghostscript-library (Important)
    2020-12-01
    oval:org.opensuse.security:def:40560
    P
    		Security update for bash (Important)
    2020-12-01
    oval:org.opensuse.security:def:41643
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:20208
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:29242
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:34299
    P
    		Security update for python27 (Important)
    2020-12-01
    oval:org.opensuse.security:def:39452
    P
    		Security update for php5 (Important)
    2020-12-01
    oval:org.opensuse.security:def:57315
    P
    		Security update for curl
    2020-12-01
    oval:org.opensuse.security:def:41655
    P
    		Security update for java-1_7_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:28167
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:43279
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:34839
    P
    		Security update for bind (Critical)
    2020-12-01
    oval:org.opensuse.security:def:30952
    P
    		Security update for gnuplot (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35193
    P
    		Security update for libQt
    2020-12-01
    oval:org.opensuse.security:def:21085
    P
    		Security update for openldap2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:34203
    P
    		Security update for perl-Config-General
    2020-12-01
    oval:org.opensuse.security:def:56239
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:30644
    P
    		Security update for xorg-x11-libXrender
    2020-12-01
    oval:org.opensuse.security:def:34946
    P
    		Security update for MozillaFirefox, mozilla-nspr, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:39922
    P
    		Security update for graphite2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31037
    P
    		Security update for kdebase4-runtime
    2020-12-01
    oval:org.opensuse.security:def:20170
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28604
    P
    		Security update for vino
    2020-12-01
    oval:org.opensuse.security:def:34215
    P
    		Security update for php5 (Important)
    2020-12-01
    oval:org.opensuse.security:def:39394
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:57207
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:41644
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:28110
    P
    		Security update for glibc (Important)
    2020-12-01
    oval:org.opensuse.security:def:43234
    P
    		Security update for ntp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57407
    P
    		Security update for libgcrypt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30951
    P
    		Security update for gnome-session (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35057
    P
    		Security update for java-1_6_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:28505
    P
    		Security update for openssh-openssl1 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30557
    P
    		Security update for libgcrypt
    2020-12-01
    oval:org.opensuse.security:def:39877
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:30963
    P
    		Security update for gpgme
    2020-12-01
    oval:org.opensuse.security:def:20136
    P
    		Security update for the Linux Kernel (Live Patch 23 for SLE 12) (Important)
    2020-12-01
    oval:org.opensuse.security:def:28560
    P
    		Security update for hplip
    2020-12-01
    oval:org.opensuse.security:def:32448
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:34204
    P
    		Security update for perl-DBD-mysql (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:39291
    P
    		Security update for slurm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34961
    P
    		Security update for freetype2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28026
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:31405
    P
    		Security update for perl-DBI (Important)
    2020-12-01
    oval:org.opensuse.security:def:39761
    P
    		Security update for jasper (Important)
    2020-12-01
    oval:org.opensuse.security:def:31006
    P
    		Security update for java-1_6_0-ibm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34973
    P
    		Security update for gd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28456
    P
    		Security update for xen (Important)
    2020-12-01
    oval:com.ubuntu.disco:def:2019120670000000
    V
    		CVE-2019-12067 on Ubuntu 19.04 (disco) - low.
    2019-08-12
    oval:com.ubuntu.bionic:def:2019120670000000
    V
    		CVE-2019-12067 on Ubuntu 18.04 LTS (bionic) - low.
    2019-08-12
    oval:com.ubuntu.xenial:def:2019120670000000
    V
    		CVE-2019-12067 on Ubuntu 16.04 LTS (xenial) - low.
    2019-08-12
    BACK
    qemu qemu -
    debian debian linux 9.0
    debian debian linux 10.0
    debian debian linux 11.0
    fedoraproject fedora 30
    redhat enterprise linux 8.0
    redhat enterprise linux 8.0
    redhat openstack platform 10.0
    redhat openstack platform 14.0
    qemu qemu -