Linux Kernel up to 5.3.2 SSID net/wireless/wext-sme.c cfg80211_mgd_wext_giwessid buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 5.3.2. Affected by this vulnerability is the function cfg80211_mgd_wext_giwessid of the file net/wireless/wext-sme.c of the component SSID Handler. The manipulation results in buffer overflow. This vulnerability is identified as CVE-2019-17133. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in Linux Kernel up to 5.3.2 (Operating System). Affected is the function cfg80211_mgd_wext_giwessid of the file net/wireless/wext-sme.c of the component SSID Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.

The weakness was released 10/04/2019 (Website). The advisory is shared for download at seclists.org. This vulnerability is traded as CVE-2019-17133 since 10/04/2019. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 10/15/2024).

The vulnerability scanner Nessus provides a plugin with the ID 208574 (CentOS 7 : kernel-alt (RHSA-2020:0174)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (208574). Entries connected to this vulnerability are available at VDB-140231, VDB-140279, VDB-140280 and VDB-140286. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.3.0
• 5.3.1
• 5.3.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion