CVE-2019-10126: Buffer Overflow
A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiexuapparsetailies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences.
Other sources
A flaw was found in the Linux kernels implementation of the mwifiex wireless kernel driver. A remote attacker in control of an wireless access point may be able to create a heap-overflow in the access-point handling code. This heap overflow may lead to memory corruption and possibly priviledge escalation.
References:
https://lore.kernel.org/linux-wireless/20190531131841.7552-1-tiwai@suse.de/
— Red Hat
A flaw was found in the mwifiex implementation in the Linux kernel. A system connecting to wireless access point could be manipulated by an attacker with advanced permissions on the access point into localized memory corruption or possibly privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.4.1.rt56.1027.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.4.1.el7 - Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.17.1.el7a - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-957.54.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.rt24.93.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-80.15.1.el8_0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-10126?
CVE-2019-10126 is considered a high severity vulnerability due to its potential for memory corruption.
How do I fix CVE-2019-10126?
To mitigate CVE-2019-10126, update to the patched kernel versions as specified in the advisory.
Which software is affected by CVE-2019-10126?
CVE-2019-10126 affects various versions of the Linux kernel, including specific Red Hat and Debian distributions.
Can CVE-2019-10126 be exploited remotely?
Yes, CVE-2019-10126 could potentially be exploited by an attacker to gain unauthorized access.
What systems are primarily impacted by CVE-2019-10126?
CVE-2019-10126 primarily impacts systems using affected versions of the Linux kernel, particularly in wireless environments.