Bug 1744137 (CVE-2019-14815) - CVE-2019-14815 kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS
Summary: CVE-2019-14815 kernel: heap-overflow in mwifiex_set_wmm_params() function of ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-14815
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1776243 1776244 1776246 1776247 1776618 1776622 1776225 1776242 1776245 1785197 1785198
Blocks: 1744138
TreeView+ depends on / blocked
 
Reported: 2019-08-21 12:36 UTC by Marian Rehak
Modified: 2020-01-21 20:09 UTC (History)
49 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability found in the Linux kernel's WMM implementation for Marvell WiFi-based hardware (mwifiex) could lead to a denial of service or allow arbitrary code execution. For this flaw to be executed, the attacker must be both local and privileged. There is no mitigation to this flaw. A patch has been provided to remediate this flaw.
Clone Of:
Environment:
Last Closed: 2020-01-21 20:09:43 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:0174 None None None 2020-01-21 15:50:07 UTC

Description Marian Rehak 2019-08-21 12:36:34 UTC
A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver.

Reference:
https://www.openwall.com/lists/oss-security/2019/08/28/1
https://lore.kernel.org/linux-wireless/20190828020751.13625-1-huangwenabc@gmail.com/
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14815

Comment 2 msiddiqu 2019-08-28 19:57:53 UTC
Acknowledgments:

Name: Huangwen (ADLab of Venustech)

Comment 4 Jarod Wilson 2019-11-22 16:20:39 UTC
For some reason, I'm not able to access bug 1744138, which I'd assume is the RHEL-8-specific bug I need to address in my wireless update... Can someone please take a look at this? Prepping a big wireless update for RHEL-8 right now, and want to include all these CVE bugs.

Comment 5 John W. Linville 2019-11-22 18:28:10 UTC
FWIW, I cannot see bug 1744138 either.

Comment 6 Wade Mealing 2019-11-25 10:04:18 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1776225]

Comment 7 Wade Mealing 2019-11-25 10:17:03 UTC
These are not rhel8 bugs, thats a task bug that is private to product security team. I'll be making the trackers for this today.

Comment 8 msiddiqu 2019-11-25 10:19:45 UTC
Clearing needinfo based on comment 7

Comment 15 Justin M. Forbes 2019-11-25 15:45:15 UTC
This was fixed for Fedora with the 5.2.17 stable kernel updates.

Comment 17 errata-xmlrpc 2020-01-21 15:50:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0174 https://access.redhat.com/errata/RHSA-2020:0174

Comment 18 Product Security DevOps Team 2020-01-21 20:09:43 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14815


Note You need to log in before you can comment on or make changes to this bug.