An issue was discovered in the Linux kernels wifi beacon validation code. The parser does not check the length of variable length elements in the beacon head. This could lead to a buffer overflow in code that relies on these values being within the specification. Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f88eb7c0d002a67ef31aeb7850b42ff69abc46dc
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1760307]
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:1016 https://access.redhat.com/errata/RHSA-2020:1016
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:1070 https://access.redhat.com/errata/RHSA-2020:1070
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-16746