CVE-2019-17133
published 2019-10-04CVE-2019-17133: In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
6.65%
93.2th percentile
In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 5.3.9-1 (bookworm) | linux 5.3.9-1 (bookworm) |
| linux | linux_kernel | >= 0 < 5.3.9-1 | 5.3.9-1 |
| linux | linux_kernel | >= 0 < 5.3.9-1 | 5.3.9-1 |
| linux | linux_kernel | >= 0 < 5.3.9-1 | 5.3.9-1 |
| linux | linux_kernel | >= 0 < 5.3.9-1 | 5.3.9-1 |
| linux | linux_kernel | >= 0 < 4.4.0-170.199 | 4.4.0-170.199 |
| linux | linux_kernel | >= 0 < 4.15.0-72.81 | 4.15.0-72.81 |
| linux | linux_kernel | >= 2.6.32 < 3.16.77 | 3.16.77 |
| linux | linux_kernel | >= 3.17 < 4.4.198 | 4.4.198 |
| linux | linux_kernel | >= 4.10 < 4.14.151 | 4.14.151 |
| linux | linux_kernel | >= 4.15 < 4.19.81 | 4.19.81 |
| linux | linux_kernel | >= 4.20 < 5.3.8 | 5.3.8 |
| linux | linux_kernel | >= 4.5 < 4.9.198 | 4.9.198 |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4v38-w5qx-qhmh: In the Linux kernel through 5
ghsa_unreviewed·2022-05-24
CVE-2019-17133 [CRITICAL] CWE-120 GHSA-4v38-w5qx-qhmh: In the Linux kernel through 5
In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.
OSV
linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2 vulnerabilities
osv·2020-01-07·CVSS 8.8
CVE-2019-10220 [HIGH] linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2 vulnerabilities
linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2 vulnerabilities
Michael Hanselmann discovered that the CIFS implementation in the Linux
kernel did not sanitize paths returned by an SMB server. An attacker
controlling an SMB server could use this to overwrite arbitrary files.
(CVE-2019-10220)
It was discovered that a heap-based buffer overflow existed in the Marvell
WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-14895, CVE-2019-14901)
It was discovered that a heap-based buffer overflow existed in the Marvell
Libertas WLAN Driver for the Linux kernel. A physically proxi
OSV
linux-lts-xenial, linux-aws vulnerabilities
osv·2019-12-03·CVSS 9.8
CVE-2018-20784 [CRITICAL] linux-lts-xenial, linux-aws vulnerabilities
linux-lts-xenial, linux-aws vulnerabilities
USN-4211-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 ESM.
Zhipeng Xie discovered that an infinite loop could be triggered in the CFS
Linux kernel process scheduler. A local attacker could possibly use this to
cause a denial of service. (CVE-2018-20784)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
Nicolas Waisman discovered that the Chelsio T4/T5 RDMA Driver for the Linux
kernel performed DMA from a kernel stack. A l
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-12-03·CVSS 9.8
CVE-2018-20784 [CRITICAL] linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
Zhipeng Xie discovered that an infinite loop could be triggered in the CFS
Linux kernel process scheduler. A local attacker could possibly use this to
cause a denial of service. (CVE-2018-20784)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
Nicolas Waisman discovered that the Chelsio T4/T5 RDMA Driver for the Linux
kernel performed DMA from a kernel stack. A local attacker could use this
to cause a denial of service (system crash). (CVE-2019-17075)
OSV
linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-12-03·CVSS 9.8
CVE-2019-16746 [CRITICAL] linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that a buffer overflow existed in the 802.11 Wi-Fi
configuration interface for the Linux kernel when handling beacon settings.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2019-16746)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
a
OSV
linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-kvm, linux-oracle vulnerabilities
osv·2019-12-02·CVSS 6.7
CVE-2019-15794 [MEDIUM] linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-kvm, linux-oracle vulnerabilities
linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-kvm, linux-oracle vulnerabilities
Jann Horn discovered that the OverlayFS and ShiftFS Drivers in the Linux
kernel did not properly handle reference counting during memory mapping
operations when used in conjunction with AUFS. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-15794)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
It was discovered that the ARM Komeda display driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
attacker could use this
OSV
CVE-2019-17133: In the Linux kernel through 5
osv·2019-10-04·CVSS 9.8
CVE-2019-17133 [CRITICAL] CVE-2019-17133: In the Linux kernel through 5
In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-01-07·CVSS 8.8
CVE-2019-10220 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Michael Hanselmann discovered that the CIFS implementation in the Linux
kernel did not sanitize paths returned by an SMB server. An attacker
controlling an SMB server could use this to overwrite arbitrary files.
(CVE-2019-10220)
It was discovered that a heap-based buffer overflow existed in the Marvell
WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-14895, CVE-2019-14901)
It was discovered that a heap-based buffer overflow existed in the Marvell
Libertas WLAN Driver for the Linux kernel. A physically proximate attacker
could use this to cause a denial of service
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2019-12-03·CVSS 9.8
CVE-2018-20784 [CRITICAL] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-4211-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 ESM.
Zhipeng Xie discovered that an infinite loop could be triggered in the CFS
Linux kernel process scheduler. A local attacker could possibly use this to
cause a denial of service. (CVE-2018-20784)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
Nicolas Waisman discovered that the Chelsio T4/T5
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-12-03·CVSS 9.8
CVE-2019-16746 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a buffer overflow existed in the 802.11 Wi-Fi
configuration interface for the Linux kernel when handling beacon settings.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2019-16746)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
attacker could use this to cause a denial of service
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-12-03·CVSS 9.8
CVE-2018-20784 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zhipeng Xie discovered that an infinite loop could be triggered in the CFS
Linux kernel process scheduler. A local attacker could possibly use this to
cause a denial of service. (CVE-2018-20784)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
Nicolas Waisman discovered that the Chelsio T4/T5 RDMA Driver for the Linux
kernel performed DMA from a kernel stack. A local attacker could use this
to cause a denial of service (system crash). (CVE-2019-17075)
Instructions: After a standard system update you need to reboot
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-12-02·CVSS 7.1
CVE-2019-15794 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Jann Horn discovered that the OverlayFS and ShiftFS Drivers in the Linux
kernel did not properly handle reference counting during memory mapping
operations when used in conjunction with AUFS. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-15794)
Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel
did not properly validate SSID lengths. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2019-17133)
It was discovered that the ARM Komeda display driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
attac
Red Hat
kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c
vendor_redhat·2019-10-04·CVSS 9.8
CVE-2019-17133 [CRITICAL] CWE-120 kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c
kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c
In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.
A vulnerability was found in the Linux kernel's generic WiFi ESSID handling implementation. The flaw allows a system to join a wireless network where the ESSID is longer than the maximum length of 32 characters, which can cause the system to crash or execute code.
Package: kernel (Red Hat Enterprise Linux 5) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2019-17133: linux - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/we...
vendor_debian·2019·CVSS 9.8
CVE-2019-17133 [CRITICAL] CVE-2019-17133: linux - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/we...
In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.
Scope: local
bookworm: resolved (fixed in 5.3.9-1)
bullseye: resolved (fixed in 5.3.9-1)
forky: resolved (fixed in 5.3.9-1)
sid: resolved (fixed in 5.3.9-1)
trixie: resolved (fixed in 5.3.9-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-17133 kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c [fedora-all]
bugzilla·2019-11-13·CVSS 9.8
CVE-2019-17133 [CRITICAL] CVE-2019-17133 kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c [fedora-all]
CVE-2019-17133 kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affe
Bugzilla
CVE-2019-17133 kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c
bugzilla·2019-11-13·CVSS 9.8
CVE-2019-17133 [CRITICAL] CVE-2019-17133 kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c
CVE-2019-17133 kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c
A vulnerability was found in the Linux kernels generic wifi management system in the function cfg80211_mgd_wext_giwessid. Many of the wifi drivers use this software and if an attacker could trick or coerce a system to joining a wifi network with an essid longer than the standard could create a situation which could the essid data could corrupt kernel stack memory and possibly escalate privileges.
Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4ac2813cc867ae563a1ba5a9414bfb554e5796fa
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1771910]
---
This was fixed for Fedora with the 5.3.8 stable kernel updates
---
Fr
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00064.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.htmlhttp://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlhttps://access.redhat.com/errata/RHSA-2020:0174https://access.redhat.com/errata/RHSA-2020:0374https://access.redhat.com/errata/RHSA-2020:0375https://access.redhat.com/errata/RHSA-2020:0543https://access.redhat.com/errata/RHSA-2020:0592https://access.redhat.com/errata/RHSA-2020:0609https://access.redhat.com/errata/RHSA-2020:0653https://access.redhat.com/errata/RHSA-2020:0661https://access.redhat.com/errata/RHSA-2020:0664https://access.redhat.com/errata/RHSA-2020:0790https://lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlhttps://marc.info/?l=linux-wireless&m=157018270915487&w=2https://seclists.org/bugtraq/2019/Nov/11https://security.netapp.com/advisory/ntap-20191031-0005/https://usn.ubuntu.com/4208-1/https://usn.ubuntu.com/4210-1/https://usn.ubuntu.com/4211-1/https://usn.ubuntu.com/4211-2/https://usn.ubuntu.com/4226-1/https://www.oracle.com/security-alerts/cpuApr2021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00064.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.htmlhttp://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlhttps://access.redhat.com/errata/RHSA-2020:0174https://access.redhat.com/errata/RHSA-2020:0374https://access.redhat.com/errata/RHSA-2020:0375https://access.redhat.com/errata/RHSA-2020:0543https://access.redhat.com/errata/RHSA-2020:0592https://access.redhat.com/errata/RHSA-2020:0609https://access.redhat.com/errata/RHSA-2020:0653https://access.redhat.com/errata/RHSA-2020:0661https://access.redhat.com/errata/RHSA-2020:0664https://access.redhat.com/errata/RHSA-2020:0790https://lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlhttps://marc.info/?l=linux-wireless&m=157018270915487&w=2https://seclists.org/bugtraq/2019/Nov/11https://security.netapp.com/advisory/ntap-20191031-0005/https://usn.ubuntu.com/4208-1/https://usn.ubuntu.com/4210-1/https://usn.ubuntu.com/4211-1/https://usn.ubuntu.com/4211-2/https://usn.ubuntu.com/4226-1/https://www.oracle.com/security-alerts/cpuApr2021.html
2019-10-04
Published