CVE-2020-12653

moderate-risk

Published 2020-05-05

An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.

Do I need to act?

0.19% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (20)

Linux Kernel

Leap

Debian Linux

Active Iq Unified Manager

Cloud Backup

Element Software

Hci Management Node

Solidfire

Steelstore Cloud Integrated Storage

Hci Compute Node Firmware

A700S Firmware

H300S Firmware

H500S Firmware

H700S Firmware

H300E Firmware

H500E Firmware

H700E Firmware

H410S Firmware

H410C Firmware

Affected Vendors

Debian Linux Netapp Opensuse

References (20)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html

Mailing List http://www.openwall.com/lists/oss-security/2020/05/08/2

Release Notes https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.4

Patch https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b7026...

Patch https://github.com/torvalds/linux/commit/b70261a288ea4d2f4ac7cd04be08a9f0f2de4f4...

Mailing List https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html

Mailing List https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html

Mailing List https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html

Third Party Advisory https://security.netapp.com/advisory/ntap-20200608-0001/

Third Party Advisory https://www.debian.org/security/2020/dsa-4698