Linux Kernel up to 5.3.11 pcie.c mwifiex_pcie_alloc_cmdrsp_buf resource consumption

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.3.11. It has been rated as problematic. This affects the function mwifiex_pcie_alloc_cmdrsp_buf of the file drivers/net/wireless/marvell/mwifiex/pcie.c. This manipulation causes resource consumption. This vulnerability appears as CVE-2019-19056. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.3.11 (Operating System). Affected by this vulnerability is the function mwifiex_pcie_alloc_cmdrsp_buf of the file drivers/net/wireless/marvell/mwifiex/pcie.c. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932.

The weakness was presented 11/18/2019. This vulnerability is known as CVE-2019-19056 since 11/18/2019. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/23/2024). MITRE ATT&CK project uses the attack technique T1499 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-145877, VDB-145876, VDB-145875 and VDB-145874 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion