Linux Kernel up to 5.2.17 Beacon Head net/wireless/nl80211.c validate_beacon_head buffer overflow

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.2.17. It has been classified as critical. This affects the function validate_beacon_head of the file net/wireless/nl80211.c of the component Beacon Head Handler. Performing a manipulation results in buffer overflow. This vulnerability is identified as CVE-2019-16746. The attack can be initiated remotely. There is not any exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.2.17 (Operating System). It has been classified as critical. This affects the function validate_beacon_head of the file net/wireless/nl80211.c of the component Beacon Head Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow.

The weakness was released 09/24/2019 as not defined mailinglist post (Website). The advisory is shared at marc.info. This vulnerability is uniquely identified as CVE-2019-16746 since 09/24/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The advisory points out:

We currently don't validate the beacon head, i.e. the header, fixed part and elements that are to go in front of the TIM element. This means that the variable elements there can be malformed, e.g. have a length exceeding the buffer size, but most downstream code from this assumes that this has already been checked.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at marc.info. A possible mitigation has been published before and not just after the disclosure of the vulnerability. The mailinglist post contains the following remark:

Add the necessary checks to the netlink policy.

Entries connected to this vulnerability are available at VDB-142131, VDB-142712 and VDB-142713. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.2.7
• 5.2.8
• 5.2.9
• 5.2.10
• 5.2.11
• 5.2.12
• 5.2.13
• 5.2.14
• 5.2.15
• 5.2.16
• 5.2.17

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion