CVE-2019-14901

Aliases:UBUNTU-CVE-2019-14901DEBIAN-CVE-2019-14901
Advisory lineage Upstream: 0 Downstream: 34
Modified
Published: 29 Nov 2019, 14:05
Last modified:05 Aug 2024, 00:26

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
10 HIGH
v2.0 (nvd)
EPSS Score
16.91% MEDIUM
17% probability +11.44%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

29 Nov 2019, 14:05
Published
Vulnerability first disclosed
05 Aug 2024, 00:26
Last Modified
Vulnerability information updated

Description

A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.0•HIGH•Score: 8.8CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 10AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 16.91%• Percentile: 97%

Techniques & Countermeasures

  • CWE-122•Heap-based Buffer Overflow

    A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

  • CWE-787•Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • canonical•ubuntu_linux

    14.04 | 16.04 | 18.04 | 19.10

  • debian•linux

    < 5.4.13-1 | < 5.4.13-1 | < 5.4.13-1 | < 5.4.13-1

  • ubuntu•linux

    all | < 4.4.0-171.200 | < 4.15.0-74.84

  • ubuntu•linux-aws

    < 4.4.0-1060.64 | < 4.4.0-1100.111 | < 4.15.0-1057.59

  • ubuntu•linux-aws-5.0

    < 5.0.0-1023.26~18.04.1

  • ubuntu•linux-aws-fips

    < 4.15.0-2018.18 | all

  • ubuntu•linux-aws-hwe

    < 4.15.0-1057.59~16.04.1

  • ubuntu•linux-azure

    < 4.15.0-1066.71~14.04.1 | < 4.15.0-1066.71 | < 5.0.0-1028.30~18.04.1

  • ubuntu•linux-azure-5.3

    < 5.3.0-1009.10~18.04.1

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-azure-fde

    all

  • ubuntu•linux-azure-fde-5.15

    < 5.15.0-1114.123~20.04.1

  • ubuntu•linux-azure-fips

    < 4.15.0-2006.7 | all

  • ubuntu•linux-bluefield

    all

  • ubuntu•linux-fips

    < 4.4.0-1027.32 | all

  • ubuntu•linux-gcp

    < 4.15.0-1052.56 | < 5.0.0-1028.29~18.04.1

  • ubuntu•linux-gcp-5.3

    < 5.3.0-1010.11~18.04.1

  • ubuntu•linux-gcp-edge

    all

  • ubuntu•linux-gcp-fips

    all

  • ubuntu•linux-gke

    all

  • ubuntu•linux-gke-4.15

    < 4.15.0-1050.53

  • ubuntu•linux-gke-5.0

    < 5.0.0-1027.28~18.04.1

  • ubuntu•linux-hwe

    < 4.15.0-74.83~16.04.1 | < 5.3.0-26.28~18.04.1

  • ubuntu•linux-hwe-edge

    all | all

  • ubuntu•linux-intel-iot-realtime

    all

  • ubuntu•linux-kvm

    < 4.4.0-1064.71 | < 4.15.0-1052.52

  • ubuntu•linux-lts-xenial

    < 4.4.0-171.200~14.04.1

  • ubuntu•linux-oem

    < 4.15.0-1066.76

  • ubuntu•linux-oem-osp1

    < 5.0.0-1033.38

  • ubuntu•linux-oracle

    < 4.15.0-1031.34~16.04.1 | < 4.15.0-1031.34

  • ubuntu•linux-oracle-5.0

    < 5.0.0-1009.14~18.04.1

  • ubuntu•linux-raspi-realtime

    all

  • ubuntu•linux-raspi2

    < 4.4.0-1127.136 | < 4.15.0-1053.57 | all

  • ubuntu•linux-realtime

    all

  • ubuntu•linux-riscv

    all | all

  • ubuntu•linux-snapdragon

    < 4.4.0-1131.139 | < 4.15.0-1070.77

  • debian•debian_linux

    8.0

  • fedoraproject•fedora

    30 | 31

  • linux•linux_kernel

    ≥ 3.15, < 3.16.83 | ≥ 3.17, < 4.4.217 | ≥ 4.5, < 4.9.217 | ≥ 4.10, < 4.14.164 | ≥ 4.15, < 4.19.95 | ≥ 4.20, < 5.4.11

  • red hat•kernel

    all kernel versions 3.x.x and 4.x.x before 4.18.0

References (33)