CVE-2020-12654
published 2020-05-05CVE-2020-12654: An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a…
PriorityP433high7.1CVSS 3.1
AVAACHPRNUIRSUCHIHAH
EPSS
1.22%
65.6th percentile
An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.5.13-1 (bookworm) | linux 5.5.13-1 (bookworm) |
| linux | linux_kernel | < 5.5.4 | 5.5.4 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 3.13.0-180.231 | 3.13.0-180.231 |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_kernel_5.4.91-11_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.04.3MEDIUMAV:A/AC:H/Au:N/C:P/I:P/A:P
osv7.1HIGH
vendor_debian7.1HIGH
vendor_msrc7.1HIGH
vendor_redhat7.1HIGH
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-06-10·CVSS 5.5
CVE-2020-0543 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Marvell WiFi-Ex Driver in the Linux kernel did
not properly validate status lengths in messages received from an access
point, leading to a buffer overflow. A physically proximate attacker
controlling an access point could use this to construct messages that could
possibly result in arbitrary code execution. (CVE-2020-12654)
It was discovered that memory contents previously stored in
microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY
read operations on Intel client and Xeon E3 processors may be briefly
exposed to processes on the same or different processor cores. A local
attacker could use this to expose sensitive information. (CVE-2020
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-06-10·CVSS 5.5
CVE-2020-0543 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Marvell WiFi-Ex Driver in the Linux kernel did
not properly validate status lengths in messages received from an access
point, leading to a buffer overflow. A physically proximate attacker
controlling an access point could use this to construct messages that could
possibly result in arbitrary code execution. (CVE-2020-12654)
It was discovered that memory contents previously stored in
microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY
read operations on Intel client and Xeon E3 processors may be briefly
exposed to processes on the same or different processor cores. A local
attacker could use this to expose sensitive information. (CVE-2020
Microsoft
An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an inc
vendor_msrc·2020-05-12·CVSS 7.1
CVE-2020-12654 [HIGH] CWE-787 An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an inc
An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy aka CID-3a9b153c5591.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional product
Red Hat
kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c
vendor_redhat·2020-01-27·CVSS 7.1
CVE-2020-12654 [HIGH] CWE-122 kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c
kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c
An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.
A flaw was found in the Linux kernel. The Marvell mwifiex driver allows a remote WiFi access point to trigger a heap-based memory buffer overflow due to an incorrect memcpy operation. The highest threat from this vulnerability is to data integrity and system availability.
Mitigation: In order to mitigate this issue, it is possible to prevent the affected code from being loaded by blacklisting the kernel module mwifiex. For instructions
Debian
CVE-2020-12654: linux - An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in...
vendor_debian·2020·CVSS 7.1
CVE-2020-12654 [HIGH] CVE-2020-12654: linux - An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in...
An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.
Scope: local
bookworm: resolved (fixed in 5.5.13-1)
bullseye: resolved (fixed in 5.5.13-1)
forky: resolved (fixed in 5.5.13-1)
sid: resolved (fixed in 5.5.13-1)
trixie: resolved (fixed in 5.5.13-1)
GHSA
GHSA-r2mg-x3w3-w45q: An issue was found in Linux kernel before 5
ghsa_unreviewed·2022-05-24
CVE-2020-12654 [HIGH] GHSA-r2mg-x3w3-w45q: An issue was found in Linux kernel before 5
An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.
Kernel
fortify: Detect struct member overflows in memcpy() at compile-time
kernel_security·2021-04-20
CVE-2019-0145 fortify: Detect struct member overflows in memcpy() at compile-time
fortify: Detect struct member overflows in memcpy() at compile-time
memcpy() is dead; long live memcpy()
tl;dr: In order to eliminate a large class of common buffer overflow
flaws that continue to persist in the kernel, have memcpy() (under
CONFIG_FORTIFY_SOURCE) perform bounds checking of the destination struct
member when they have a known size. This would have caught all of the
memcpy()-related buffer write overflow flaws identified in at least the
last three years.
Background and analysis:
While stack-based buffer overflow flaws are largely mitigated by stack
canaries (and similar) features, heap-based buffer overflow flaws continue
to regularly appear in the kernel. Many classes of heap buffer overflows
are mitigated by FORTIFY_SOURCE when using the strcpy() family of
functions, b
OSV
linux, linux-lts-trusty vulnerabilities
osv·2020-06-10·CVSS 5.5
CVE-2020-12654 [MEDIUM] linux, linux-lts-trusty vulnerabilities
linux, linux-lts-trusty vulnerabilities
It was discovered that the Marvell WiFi-Ex Driver in the Linux kernel did
not properly validate status lengths in messages received from an access
point, leading to a buffer overflow. A physically proximate attacker
controlling an access point could use this to construct messages that could
possibly result in arbitrary code execution. (CVE-2020-12654)
It was discovered that memory contents previously stored in
microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY
read operations on Intel client and Xeon E3 processors may be briefly
exposed to processes on the same or different processor cores. A local
attacker could use this to expose sensitive information. (CVE-2020-0543)
Piotr Krysiuk discovered that race conditions existed
OSV
CVE-2020-12654: An issue was found in Linux kernel before 5
osv·2020-05-05·CVSS 7.1
CVE-2020-12654 [HIGH] CVE-2020-12654: An issue was found in Linux kernel before 5
An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-12654 kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c
bugzilla·2020-05-06·CVSS 7.1
CVE-2020-12654 [HIGH] CVE-2020-12654 kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c
CVE-2020-12654 kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c
An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy.
Reference and upstream commit:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.4
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a9b153c5591548612c3955c9600a98150c81875
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1832531]
---
This was fixed for Fedora with the 5.4.20 stable kernel updates.
---
This issue has been addressed in the following products:
Red Hat Ent
Bugzilla
CVE-2020-12654 kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c [fedora-all]
bugzilla·2020-05-06·CVSS 7.1
CVE-2020-12654 [HIGH] CVE-2020-12654 kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c [fedora-all]
CVE-2020-12654 kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg
arXiv
Securing Monolithic Kernels using Compartmentalization
arxiv_fulltext·2024-04-12
Securing Monolithic Kernels using Compartmentalization
Securing Monolithic Kernels using Compartmentalization
Soo Yee Lim
University of British Columbia
Canada
Sidhartha Agrawal
University of British Columbia
Canada
Xueyuan Han
Wake Forest University
United States of America
David Eyers
University of Otago
New Zealand
Dan O'Keeffe
Royal Holloway University of London
United Kingdom
Thomas Pasquier
University of British Columbia
Canada
Lim, et al.
CCSXML
10002978.10003006.10003007
Security and privacy Operating systems security
500
10002978.10003006.10003007.10003010
Security and privacy Virtualization and security
100
10002978.10003022.10003023
Security and privacy Software security engineering
500
CCSXML
[500]Security and privacy Operating systems security
[100]Security and privacy Virtualization and security
[500]Securi
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.htmlhttp://www.openwall.com/lists/oss-security/2020/05/08/2https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.4https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a9b153c5591548612c3955c9600a98150c81875https://github.com/torvalds/linux/commit/3a9b153c5591548612c3955c9600a98150c81875https://lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00012.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlhttps://security.netapp.com/advisory/ntap-20200608-0001/https://usn.ubuntu.com/4392-1/https://usn.ubuntu.com/4393-1/https://www.debian.org/security/2020/dsa-4698http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.htmlhttp://www.openwall.com/lists/oss-security/2020/05/08/2https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.4https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a9b153c5591548612c3955c9600a98150c81875https://github.com/torvalds/linux/commit/3a9b153c5591548612c3955c9600a98150c81875https://lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00012.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlhttps://security.netapp.com/advisory/ntap-20200608-0001/https://usn.ubuntu.com/4392-1/https://usn.ubuntu.com/4393-1/https://www.debian.org/security/2020/dsa-4698
2020-05-05
Published