CVE-2019-20095: Medium severity Linux Linux kernel vulnerability
A flaw was found in the Linux kernel's mwifiex driver implementation when connecting to other WiFi devices in "Test Mode." A kernel memory leak can occur if an error condition is met during the parameter negotiation. This issue can lead to a denial of service if multiple error conditions meeting the repeated connection attempts are attempted.
Other sources
mwifiextmcmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service.
The Mwifiex driver implementation in the Linux kernel has a memory leak on the error condition when encountering an error condition when in 'Wifi test mode'.
Wifi test mode is a 'region' mode that wireless devices can use that allows for full use of the wifi spectrum disregarding regional laws that prohibit broadcasting in certain ranges.
This requires a connection to another wifi device in "test mode" to create the error condition.
Reference and upstream commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=003b686ace820ce2d635a83f10f2d7f9c147dabc
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.19.1.el7a - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
Linux kernel mwifiex driverto a version that resolves this vulnerability.Fixed in 5.1.6Patch CID-003b686ace82 - Compensating control
Do not connect to rogue access points or other untrusted WiFi devices in WiFi test mode.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-20095.
What is the severity level of CVE-2019-20095?
The severity level of CVE-2019-20095 is medium (5.2).
Which software versions are affected by CVE-2019-20095?
The affected software versions include Linux kernel versions before 5.1.6, redhat/kernel-rt version 0:3.10.0-1160.rt56.1131.el7, redhat/kernel-alt version 0:4.14.0-115.19.1.el7a, redhat/kernel version 0:3.10.0-1160.el7, and openSUSE Leap version 15.1.
How can I fix CVE-2019-20095?
To fix CVE-2019-20095, update your software to a version that is not vulnerable.
Where can I find more information about CVE-2019-20095?
You can find more information about CVE-2019-20095 at the following references: [Link 1](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=003b686ace820ce2d635a83f10f2d7f9c147dabc), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1791955), [Link 3](https://access.redhat.com/errata/RHSA-2020:1493).