Input validation error in Linux kernel

1) Input validation error

EUVDB-ID: #VU34924

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-20095

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.1.1 - 5.1.5

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:5.1.5:*:*:*:*:*:*:*

External links

https://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.6
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=003b686ace820ce2d635a83f10f2d7f9c147dabc
https://security.netapp.com/advisory/ntap-20200204-0002/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.