CVE-2019-14901

Advisory lineage Upstream: 0 Downstream: 34
Modified
Published: 29 Nov 2019, 14:05
Last modified:05 Aug 2024, 00:26

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
10 HIGH
v2.0 (nvd)
EPSS Score
4.67% LOW
5% probability -0.80%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

29 Nov 2019, 14:05
Published
Vulnerability first disclosed
05 Aug 2024, 00:26
Last Modified
Vulnerability information updated

Description

A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.0•HIGH•Score: 8.8CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 10AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 4.67%• Percentile: 90%

Techniques & Countermeasures

  • CWE-787•Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

  • CWE-122•Heap-based Buffer Overflow

    A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Affected Systems

  • canonical•ubuntu_linux

    14.04 | 16.04 | 18.04 | 19.10

  • debian•debian_linux

    8.0

  • fedoraproject•fedora

    30 | 31

  • linux•linux_kernel

    ≥ 3.15, < 3.16.83 | ≥ 3.17, < 4.4.217 | ≥ 4.5, < 4.9.217 | ≥ 4.10, < 4.14.164 | ≥ 4.15, < 4.19.95 | ≥ 4.20, < 5.4.11

  • red hat•kernel

    all kernel versions 3.x.x and 4.x.x before 4.18.0

References (20)