Input validation error in Linux kernel - CVE-2019-20095

Vulnerability identifier: #VU34924

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-20095

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service.

Linux kernel
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Workstation
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-alt (Red Hat package)

Install update from vendor's website.

Linux kernel - update to 5.1.6
kernel (Red Hat package) - update to 3.10.0-1160.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.rt56.1131.el7
kernel-alt (Red Hat package) - update to 4.14.0-115.19.1.el7a

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.6
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=003b686ace820ce2d635a83f10f2d7f9c147dabc
• https://security.netapp.com/advisory/ntap-20200204-0002/

• Input validation error in Linux kernel
• Red Hat Enterprise Linux 7 update for kernel-alt
• Red Hat Enterprise Linux 7 update for kernel-rt
• Red Hat Enterprise Linux 7 update for kernel