Vulnerability Description
There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 3.7, < 3.16.74 |
| Redhat | Enterprise Linux | 5.0 |
| Redhat | Enterprise Linux Eus | 8.1 |
| Redhat | Enterprise Linux For Real Time | 8 |
| Redhat | Enterprise Linux For Real Time For Nfv | 8 |
| Redhat | Enterprise Linux For Real Time For Nfv Tus | 8.2 |
| Redhat | Enterprise Linux For Real Time Tus | 8.2 |
| Redhat | Enterprise Linux Server Aus | 8.2 |
| Redhat | Enterprise Linux Server Tus | 8.2 |
| Redhat | Messaging Realtime Grid | 2.0 |
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 14.04 |
| Opensuse | Leap | 15.0 |
| Netapp | Data Availability Services | - |
| Netapp | Hci Management Node | - |
| Netapp | Service Processor | - |
| Netapp | Solidfire | - |
| Netapp | Steelstore Cloud Integrated Storage | - |
| Netapp | A700S Firmware | - |
| Netapp | A700S | - |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-SlackwarThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2019/08/28/1ExploitMailing ListPatch
- https://access.redhat.com/errata/RHSA-2020:0174Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0328Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0339Third Party Advisory
- https://access.redhat.com/security/cve/cve-2019-14814Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14814ExploitIssue TrackingPatch
- https://github.com/torvalds/linux/commit/7caac62ed598a196d6ddf8d9c121e12e082cac3PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00025.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
FAQ
What is CVE-2019-14814?
CVE-2019-14814 is a vulnerability with a CVSS score of 7.8 (HIGH). There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system cra...
How severe is CVE-2019-14814?
CVE-2019-14814 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-14814?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux For Real Time, Redhat Enterprise Linux For Real Time For Nfv.