CVE-2019-20095 — Missing Release of Memory after Effective Lifetime in Kernel

CWE-401 — Missing Release of Memory after Effective LifetimeCWE-772 — Missing Release of Resource after Effective Lifetime8 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 67.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux KernelNetapp E-series Santricity OS ControllerOpensuse Leap
Timeline
PublishedDec 30
Latest updateMay 24

Description

mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDlinux/linux_kernel< 5.1.6
▶Debianlinux/linux_kernel< 5.2.6-1+3
▶NVDopensuse/leap15.1

🔴Vulnerability Details

3
GHSA
GHSA-vc4c-8vcq-gmvh: mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211↗2022-05-24
▶
CVEList
CVE-2019-20095: mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211↗2019-12-30
▶
OSV
CVE-2019-20095: mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211↗2019-12-30
▶

📋Vendor Advisories

2
Red Hat
kernel: memory leak in mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c↗2019-12-30
▶
Debian
CVE-2019-20095: linux - mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux k...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-20095 kernel: memory leak in mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c [fedora-all]↗2020-01-16
▶
Bugzilla
CVE-2019-20095 kernel: memory leak in mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c↗2020-01-16
▶
CVE-2019-20095 — Linux Kernel vulnerability | cvebase