cbcvebase.
CVE-2019-14901
published 2019-11-29

CVE-2019-14901: A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote…

PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
16.91%
96.7th percentile
A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.

Affected

21 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debianlinux< linux 5.4.13-1 (bookworm)linux 5.4.13-1 (bookworm)
fedoraprojectfedora
fedoraprojectfedora
linuxlinux_kernel>= 0 < 5.4.13-15.4.13-1
linuxlinux_kernel>= 0 < 5.4.13-15.4.13-1
linuxlinux_kernel>= 0 < 5.4.13-15.4.13-1
linuxlinux_kernel>= 0 < 5.4.13-15.4.13-1
linuxlinux_kernel>= 0 < 4.4.0-171.2004.4.0-171.200
linuxlinux_kernel>= 0 < 4.15.0-74.844.15.0-74.84
linuxlinux_kernel>= 3.15 < 3.16.833.16.83
linuxlinux_kernel>= 3.17 < 4.4.2174.4.217
linuxlinux_kernel>= 4.10 < 4.14.1644.14.164
linuxlinux_kernel>= 4.15 < 4.19.954.19.95
linuxlinux_kernel>= 4.20 < 5.4.115.4.11
linuxlinux_kernel>= 4.5 < 4.9.2174.9.217
red_hatkernel

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerable function is mwifiex_process_tdls_action_frame() in drivers/net/wireless/marvell/mwifiex/tdls.c — monitor for heap overflow triggered by malformed TDLS frames
  • Trigger condition: a TDLS Setup Request or Response frame containing an EID_SUPP_RATES IE with length greater than 32 bytes causes the heap overflow — inspect 802.11 TDLS frames for oversized Supported Rates IEs
  • Affected kernel path for source-level or binary analysis: marvell/mwifiex/tdls.c
  • ·Vulnerability affects Linux kernel versions 3.x.x and all 4.x.x before 4.18.0; systems running kernels in this range with the Marvell WiFi (mwifiex) driver loaded are at risk
  • ·Exploitation is remote and unauthenticated — no local access required; attacker only needs to be able to send TDLS frames to the victim station
  • ·Successful code execution runs with root privileges, impacting confidentiality and integrity in addition to availability
  • ·Red Hat Enterprise Linux 5 and 6 are listed as Not Affected; Red Hat Enterprise MRG 2 (kernel-rt) is Affected
  • ·Upstream patch available at patchwork.kernel.org; Debian resolved in kernel 5.4.13-1

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.8HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.