CVE-2019-12456
An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through 5.1.5. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a "double fetch" vulnerability. NOTE: a third party reports that this is unexploitable because the doubly fetched value is not used
Timeline
ID reserved
By mitre
Published
- 5 years later
· 5 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.42% · top 63% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
- n/a
Affected products
n/a
- affected n/a
References (10)
- https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=5.3/scsi-queue&id=86e5aca7fa2927060839f3e3b40c8bd65a7e8d1e (opens in a new tab)x_refsource_MISCx_transferred
- https://lkml.org/lkml/2019/5/29/1164 (opens in a new tab)x_refsource_MISCx_transferred
- FEDORA-2019-c03eda3cc6 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- FEDORA-2019-83858fc57b (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- openSUSE-SU-2019:1570 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- openSUSE-SU-2019:1571 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- openSUSE-SU-2019:1579 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- https://bugzilla.redhat.com/show_bug.cgi?id=1717182 (opens in a new tab)x_refsource_MISCx_transferred
- https://support.f5.com/csp/article/K84310302 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://support.f5.com/csp/article/K84310302?utm_source=f5support&%3Butm_medium=RSS (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-12456)Record last updated .