CVE-2020-12653: Buffer Overflow
First published: Mon Jan 27 2020(Updated: )
An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:3.10.0-1127.18.2.rt56.1116.el7 | 0:3.10.0-1127.18.2.rt56.1116.el7 |
| redhat/kernel | <0:3.10.0-1127.18.2.el7 | 0:3.10.0-1127.18.2.el7 |
| redhat/kernel | <0:3.10.0-327.90.2.el7 | 0:3.10.0-327.90.2.el7 |
| redhat/kernel | <0:3.10.0-514.78.1.el7 | 0:3.10.0-514.78.1.el7 |
| redhat/kernel | <0:3.10.0-693.72.1.el7 | 0:3.10.0-693.72.1.el7 |
| redhat/kernel | <0:3.10.0-957.58.2.el7 | 0:3.10.0-957.58.2.el7 |
| redhat/kernel | <0:3.10.0-1062.31.2.el7 | 0:3.10.0-1062.31.2.el7 |
| redhat/kernel-rt | <0:4.18.0-193.13.2.rt13.65.el8_2 | 0:4.18.0-193.13.2.rt13.65.el8_2 |
| redhat/kernel | <0:4.18.0-193.13.2.el8_2 | 0:4.18.0-193.13.2.el8_2 |
| redhat/kernel | <0:4.18.0-80.27.1.el8_0 | 0:4.18.0-80.27.1.el8_0 |
| redhat/kernel | <0:4.18.0-147.24.2.el8_1 | 0:4.18.0-147.24.2.el8_1 |
| redhat/kernel-rt | <1:3.10.0-693.72.1.rt56.672.el6 | 1:3.10.0-693.72.1.rt56.672.el6 |
| debian/linux | 4.19.249-2 4.19.289-2 5.10.197-1 5.10.191-1 6.1.66-1 6.1.69-1 6.5.13-1 6.6.9-1 | |
| Linux Kernel | <5.5.4 | |
| SUSE Linux | =15.1 | |
| Debian Linux | =8.0 | |
| Debian Linux | =9.0 | |
| NetApp Active IQ Unified Manager for VMware vSphere | ||
| NetApp Cloud Backup | ||
| NetApp Management Services for Element Software | ||
| NetApp SolidFire & HCI Management Node | ||
| NetApp SolidFire & HCI Storage Node | ||
| NetApp SteelStore Cloud Integrated Storage | ||
| NetApp HCI Compute Node Firmware | ||
| NetApp HCI Compute Node | ||
| NetApp AFF A700s Firmware | ||
| NetApp A700 | ||
| NetApp H300S Firmware | ||
| NetApp H300S Firmware | ||
| NetApp H500e Firmware | ||
| NetApp H500e Firmware | ||
| NetApp H700S | ||
| NetApp H700S | ||
| NetApp H300E | ||
| NetApp H300E Firmware | ||
| NetApp H500S Firmware | ||
| NetApp H500e Firmware | ||
| NetApp H700E | ||
| NetApp H700E | ||
| NetApp H410S | ||
| NetApp H410S Firmware | ||
| NetApp H410C | ||
| NetApp H410C Firmware | ||
| NetApp H610C | ||
| NetApp H610C Firmware | ||
| NetApp HCI H610S Firmware | ||
| NetApp H610S Firmware | ||
| NetApp H615C | ||
| NetApp H615C |
Remedy
In order to mitigate this issue it is possible to prevent the affected code from being loaded by blacklisting the kernel module mwifiex. For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html
- http://www.openwall.com/lists/oss-security/2020/05/08/2
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.4
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4d
- https://github.com/torvalds/linux/commit/b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4d
- https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
- https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html
- https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html
- https://security.netapp.com/advisory/ntap-20200608-0001/
- https://www.debian.org/security/2020/dsa-4698
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1831870
- https://access.redhat.com/solutions/41278
- https://access.redhat.com/errata/RHSA-2020:2832
- https://access.redhat.com/security/cve/cve-2020-12653
- https://access.redhat.com/errata/RHSA-2020:3010
- https://access.redhat.com/errata/RHSA-2020:3016
- https://access.redhat.com/errata/RHSA-2020:3041
- https://access.redhat.com/errata/RHSA-2020:3220
- https://access.redhat.com/errata/RHSA-2020:3221
- https://access.redhat.com/errata/RHSA-2020:3222
- https://access.redhat.com/errata/RHSA-2020:3224
- https://access.redhat.com/errata/RHSA-2020:3226
- https://access.redhat.com/errata/RHSA-2020:3232
- https://access.redhat.com/errata/RHSA-2020:3389
- https://access.redhat.com/errata/RHSA-2020:3432
- https://bugzilla.redhat.com/show_bug.cgi?id=1831868
- https://www.cve.org/CVERecord?id=CVE-2020-12653 https://nvd.nist.gov/vuln/detail/CVE-2020-12653
- https://git.kernel.org/linus/b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4d
- https://security-tracker.debian.org/tracker/CVE-2020-12653
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2020-12653?
CVE-2020-12653 is a vulnerability in the Linux kernel that allows local users to gain privileges or cause a denial of service.
What is the severity of CVE-2020-12653?
CVE-2020-12653 has a severity rating of 7.8 (high).
How does CVE-2020-12653 affect Linux kernel?
CVE-2020-12653 affects the mwifiex_cmd_append_vsie_tlv() function in the Linux kernel's Marvell WiFi-Ex driver, causing a buffer overflow.
How can local users exploit CVE-2020-12653?
Local users can exploit CVE-2020-12653 by triggering a buffer overflow through an incorrect memcpy operation.
Where can I find more information about CVE-2020-12653?
You can find more information about CVE-2020-12653 on the official Git repository and the Debian security tracker.
- collector/redhat-cve
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-12653
- agent/remedy
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- package-manager/debian
- vendor/linux
- canonical/linux kernel
- vendor/opensuse
- canonical/suse linux
- version/suse linux/15.1
- vendor/debian
- canonical/debian linux
- version/debian linux/8.0
- version/debian linux/9.0
- vendor/netapp
- canonical/netapp active iq unified manager for vmware vsphere
- canonical/netapp cloud backup
- canonical/netapp management services for element software
- canonical/netapp solidfire & hci management node
- canonical/netapp solidfire & hci storage node
- canonical/netapp steelstore cloud integrated storage
- canonical/netapp hci compute node firmware
- canonical/netapp hci compute node
- canonical/netapp aff a700s firmware
- canonical/netapp a700
- canonical/netapp h300s firmware
- canonical/netapp h500e firmware
- canonical/netapp h700s
- canonical/netapp h300e
- canonical/netapp h300e firmware
- canonical/netapp h500s firmware
- canonical/netapp h700e
- canonical/netapp h410s
- canonical/netapp h410s firmware
- canonical/netapp h410c
- canonical/netapp h410c firmware
- canonical/netapp h610c
- canonical/netapp h610c firmware
- canonical/netapp hci h610s firmware
- canonical/netapp h610s firmware
- canonical/netapp h615c