CVE-2019-14901CWE-122CWE-400

A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver

High · published November 29, 2019

CVSS v3.0
8.8
EPSS
16%
Percentile
97.0
In the wild
Unconfirmed
What it is

⚡ A heap overflow in the Linux kernel's Marvell WiFi chip driver could let an attacker crash your system or even run malicious code with root permissions! 🔥 Think of it as a delivery driver trying to squeeze a huge package through a narrow door. If the package is too big, it can cause chaos inside, just like how this flaw can crash your system or let unwanted guests in. If exploited, this vulnerability could lead to a denial of service, leaving your system unavailable at critical times. But that's not all; if an attacker succeeds in executing code, they could manipulate files with root access, compromising both the integrity and confidentiality of your data. That's a double whammy!

Put simply

Think of it as a delivery driver trying to squeeze a huge package through a narrow door. If the package is too big, it can cause chaos inside, just like how this flaw can crash your system or let unwanted guests in. This heap overflow flaw allows a remote attacker to exploit the Marvell WiFi chip driver in Linux kernel versions 3.x.x and 4.x.x prior to 4.18.0, potentially leading to system crashes or arbitrary code execution with root privileges.

What to do

If exploited, this vulnerability could lead to a denial of service, leaving your system unavailable at critical times. But that's not all; if an attacker succeeds in executing code, they could manipulate files with root access, compromising both the integrity and confidentiality of your data. That's a double whammy! To safeguard your systems, upgrade your Linux kernel to version 4.18.0 or later immediately. If you're using an older version, consider applying patches or configuring your systems to limit exposure to this vulnerability. Regularly audit your drivers and systems for updates to maintain security! You've got this! By patching your systems, you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.16473 · 97.0th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-400 · Uncontrolled Resource Consumption
Published
2019-11-29T14:05Z
EPSS history
Timeline
  • 29 NOV 14:05Z
    A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver
    cvelistv5