CVE-2019-14901
Published: 29 November 2019
A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.
From the Ubuntu Security Team
It was discovered that a heap-based buffer overflow existed in the Marvell WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
Priority
Status
Package | Release | Status |
---|---|---|
linux-aws Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1057.59)
|
disco |
Released
(5.0.0-1023.26)
|
|
eoan |
Released
(5.3.0-1009.10)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Released
(4.4.0-1060.64)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Needed
|
|
xenial |
Released
(4.4.0-1100.111)
|
|
linux-aws-hwe Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Released
(4.15.0-1057.59~16.04.1)
|
|
linux-aws-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1023.26~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-azure-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1009.10~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-oracle-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1011.12~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-74.84)
|
disco |
Released
(5.0.0-38.41)
|
|
eoan |
Released
(5.3.0-26.28)
|
|
focal |
Not vulnerable
(5.4.0-9.12)
|
|
trusty |
Ignored
(was needs-triage ESM criteria)
|
|
upstream |
Needed
|
|
xenial |
Released
(4.4.0-171.200)
|
|
Patches: Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
linux-azure Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1028.30~18.04.1)
|
disco |
Released
(5.0.0-1028.30)
|
|
eoan |
Released
(5.3.0-1009.10)
|
|
focal |
Not vulnerable
(5.4.0-1006.6)
|
|
trusty |
Released
(4.15.0-1066.71~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Needed
|
|
xenial |
Released
(4.15.0-1066.71)
|
|
linux-azure-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Ignored
(end of standard support, was needs-triage)
|
|
linux-gcp Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1028.29~18.04.1)
|
disco |
Released
(5.0.0-1028.29)
|
|
eoan |
Released
(5.3.0-1011.12)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Released
(4.15.0-1052.56)
|
|
linux-gcp-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1010.11~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-gcp-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-gke-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1050.53)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-gke-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1027.28~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-gke-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1011.12~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-hwe Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-26.28~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Released
(4.15.0-74.83~16.04.1)
|
|
linux-hwe-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Ignored
(end of life, was needs-triage)
|
|
linux-kvm Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1052.52)
|
disco |
Released
(5.0.0-1024.26)
|
|
eoan |
Released
(5.3.0-1009.10)
|
|
focal |
Not vulnerable
(5.4.0-1004.4)
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Released
(4.4.0-1064.71)
|
|
linux-lts-trusty Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-lts-xenial Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Released
(4.4.0-171.200~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-oem Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1066.76)
|
disco |
Ignored
(end of life)
|
|
eoan |
Released
(4.15.0-1066.76)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Ignored
(end of standard support, was needs-triage)
|
|
linux-oem-5.6 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Not vulnerable
(5.4.0-1002.4)
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-oem-osp1 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1033.38)
|
disco |
Ignored
(end of life)
|
|
eoan |
Released
(5.0.0-1033.38)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-oracle Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1031.34)
|
disco |
Released
(5.0.0-1009.14)
|
|
eoan |
Released
(5.3.0-1008.9)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Released
(4.15.0-1031.34~16.04.1)
|
|
linux-oracle-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1009.14~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-raspi2 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1053.57)
|
disco |
Released
(5.0.0-1024.25)
|
|
eoan |
Released
(5.3.0-1015.17)
|
|
focal |
Ignored
(end of life, was needed)
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Released
(4.4.0-1127.136)
|
|
linux-raspi2-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1017.19~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Does not exist
|
|
linux-snapdragon Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1070.77)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needed
|
|
xenial |
Released
(4.4.0-1131.139)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 9.8 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14901
- https://seclists.org/oss-sec/2019/q4/96
- https://patchwork.kernel.org/patch/11257535/
- https://lore.kernel.org/linux-wireless/20191129101054.2756-1-wangqize888888888@gmail.com/
- https://ubuntu.com/security/notices/USN-4225-1
- https://ubuntu.com/security/notices/USN-4226-1
- https://ubuntu.com/security/notices/USN-4227-1
- https://ubuntu.com/security/notices/USN-4228-1
- https://ubuntu.com/security/notices/USN-4227-2
- https://ubuntu.com/security/notices/USN-4228-2
- https://ubuntu.com/security/notices/USN-4225-2
- NVD
- Launchpad
- Debian