CVE-2019-14895

Q: What is the severity of CVE-2019-14895?

CVE-2019-14895 has a CVSS score of 9.8 (CRITICAL). A heap-based buffer overflow vulnerability in Marvell WiFi chip drivers in Linux kernel versions 3.x.x and 4.x.x before 4.18.0 allows remote attackers to potentially execute arbitrary code or cause denial of service (system crash) during connection negotiation. This affects all Linux systems using vulnerable Marvell WiFi hardware with the affected kernel versions. The vulnerability is remotely exploitable without authentication.

9.8 CRITICAL

Denial of Service Buffer Overflow

📋 TL;DR

A heap-based buffer overflow vulnerability in Marvell WiFi chip drivers in Linux kernel versions 3.x.x and 4.x.x before 4.18.0 allows remote attackers to potentially execute arbitrary code or cause denial of service (system crash) during connection negotiation. This affects all Linux systems using vulnerable Marvell WiFi hardware with the affected kernel versions. The vulnerability is remotely exploitable without authentication.

💻 Affected Systems

Products:

Linux kernel with Marvell WiFi chip drivers

Versions: Linux kernel versions 3.x.x and 4.x.x before 4.18.0

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Marvell WiFi hardware where the vulnerable driver is loaded. Many enterprise systems may not use Marvell WiFi chips.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with kernel privileges leading to complete system compromise, data theft, or persistent backdoor installation.

🟠

Likely Case

Denial of service (system crash/kernel panic) disrupting operations and requiring physical or remote console access to reboot.

🟢

If Mitigated

If WiFi is disabled or vulnerable drivers aren't loaded, no impact. With proper network segmentation, impact is limited to WiFi network segment.

🌐 Internet-Facing: HIGH - Exploitable remotely over WiFi without authentication, potentially from nearby attackers.

🏢 Internal Only: MEDIUM - Requires attacker to be within WiFi range or have compromised internal network access to WiFi segment.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploit requires WiFi proximity or network access. Public exploit code exists in security advisories. Kernel heap exploitation requires specific timing and memory layout.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel 4.18.0 and later

Vendor Advisory: https://access.redhat.com/errata/RHSA-2020:0328

Restart Required: Yes

Instructions:

1. Update kernel to version 4.18.0 or later. 2. For older distributions, apply backported patches from your vendor. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Disable Marvell WiFi driver

linux

Prevent loading of vulnerable driver module

echo 'blacklist mwifiex' >> /etc/modprobe.d/blacklist.conf
rmmod mwifiex

Disable WiFi interface

linux

Turn off WiFi to prevent remote exploitation

ip link set wlan0 down
nmcli radio wifi off

🧯 If You Can't Patch

Segment WiFi network from critical systems using VLANs or firewalls
Implement strict WiFi access controls and monitor for suspicious connection attempts

🔍 How to Verify

Check if Vulnerable:

Check kernel version: uname -r. If version is between 3.0.0 and 4.17.x, check if Marvell driver is loaded: lsmod | grep mwifiex

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is 4.18.0 or later: uname -r. Confirm Marvell driver version is patched or not loaded.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
System crash/reboot events
WiFi driver error messages in dmesg

Network Indicators:

Unusual WiFi connection attempts to Marvell chips
Malformed WiFi negotiation packets

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "mwifiex")

📊 Metadata

CVE ID: CVE-2019-14895

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-122

Published: November 29, 2019

Last Updated: November 21, 2024

🔗 References

http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html Mailing List,Third Party Advisory
http://packetstormsecurity.com/files/155879/Kernel-Live-Patch-Security-Notice-LSN-0061-1.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.html Third Party Advisory,VDB Entry
https://access.redhat.com/errata/RHSA-2020:0328 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0339 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0374 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0375 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0543 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0592 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0609 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0653 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0661 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0664 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14895 Issue Tracking,Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4ISVNIC44SOGXTUBCIZFSUNQJ5LRKNZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MN6MLCN7G7VFTSXSZYXKXEFCUMFBUAXQ/
https://usn.ubuntu.com/4225-1/ Third Party Advisory
https://usn.ubuntu.com/4225-2/ Third Party Advisory
https://usn.ubuntu.com/4226-1/ Third Party Advisory
https://usn.ubuntu.com/4227-1/ Third Party Advisory
https://usn.ubuntu.com/4227-2/ Third Party Advisory
https://usn.ubuntu.com/4228-1/ Third Party Advisory
https://usn.ubuntu.com/4228-2/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/11/22/2 Mailing List,Patch,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html Mailing List,Third Party Advisory
http://packetstormsecurity.com/files/155879/Kernel-Live-Patch-Security-Notice-LSN-0061-1.html Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.html Third Party Advisory,VDB Entry
https://access.redhat.com/errata/RHSA-2020:0328 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0339 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0374 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0375 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0543 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0592 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0609 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0653 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0661 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0664 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14895 Issue Tracking,Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4ISVNIC44SOGXTUBCIZFSUNQJ5LRKNZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MN6MLCN7G7VFTSXSZYXKXEFCUMFBUAXQ/
https://usn.ubuntu.com/4225-1/ Third Party Advisory
https://usn.ubuntu.com/4225-2/ Third Party Advisory
https://usn.ubuntu.com/4226-1/ Third Party Advisory
https://usn.ubuntu.com/4227-1/ Third Party Advisory
https://usn.ubuntu.com/4227-2/ Third Party Advisory
https://usn.ubuntu.com/4228-1/ Third Party Advisory
https://usn.ubuntu.com/4228-2/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/11/22/2 Mailing List,Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Fedora by Fedoraproject

Fedora by Fedoraproject

Leap by Opensuse

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable Marvell WiFi driver

Disable WiFi interface

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities