CVE-2019-14283

A vulnerability was found in the Linux kernel’s floppy disk driver implementation. A local attacker with access to the floppy device could call set_geometry in drivers/block/floppy.c, which does not validate the sect and head fields, causing an integer overflow and out-of-bounds read. This flaw may crash the system or allow an attacker to gather information causing subsequent successful attacks.

Mitigation

The kernel module named 'floppy' contains the affected code, this can be blacklisted using the standard blacklisting techniques or disabled in the systems BIOS. See <https://access.redhat.com/solutions/41278&gt; for how to blacklist a kernel module.

Virtualized guest systems can also remove the system from the guests configuration to ensure that the module does not load.