CVE-2019-14814

Published: Sep 20, 2019Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.

Affected (52)

Products: Linux: Linux Kernel · Redhat: Enterprise Linux, Enterprise Linux Eus, Enterprise Linux For Real Time, Enterprise Linux For Real Time For Nfv, Enterprise Linux For Real Time For Nfv Tus, Enterprise Linux For Real Time Tus, Enterprise Linux Server Aus, Enterprise Linux Server Tus, Messaging Realtime Grid · Debian: Debian Linux · +3 more

Show all products

1 product

9 products

Enterprise Linux For Real Time

Enterprise Linux For Real Time For Nfv

Enterprise Linux For Real Time For Nfv Tus

Enterprise Linux For Real Time Tus

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Messaging Realtime Grid

1 product

1 product

1 product

21 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 3.17 to 4.4.194
Linux Linux Kernel	From 3.7 to 3.16.74
Linux Linux Kernel	From 4.10 to 4.14.146
Linux Linux Kernel	From 4.15 to 4.19.75
Linux Linux Kernel	From 4.20 to 5.2.17
Linux Linux Kernel	From 4.5 to 4.9.194

Configuration B

18 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Eus	Version 8.1
Redhat Enterprise Linux Eus	Version 8.2
Redhat Enterprise Linux Eus	Version 8.4
Redhat Enterprise Linux For Real Time	Version 8
Redhat Enterprise Linux For Real Time For Nfv	Version 8
Redhat Enterprise Linux For Real Time For Nfv Tus	Version 8.2
Redhat Enterprise Linux For Real Time For Nfv Tus	Version 8.4
Redhat Enterprise Linux For Real Time Tus	Version 8.2
Redhat Enterprise Linux For Real Time Tus	Version 8.4
Redhat Enterprise Linux Server Aus	Version 8.2
Redhat Enterprise Linux Server Aus	Version 8.4
Redhat Enterprise Linux Server Tus	Version 8.2
Redhat Enterprise Linux Server Tus	Version 8.4
Redhat Messaging Realtime Grid	Version 2.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1

Configuration F

5 vulnerable

Vulnerable Software	Affected Versions
Netapp Data Availability Services	All versions
Netapp Hci Management Node	All versions
Netapp Service Processor	All versions
Netapp Solidfire	All versions
Netapp Steelstore Cloud Integrated Storage	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A700s Firmware	All versions

Running on/with	Platform Versions
Netapp A700s	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A320 Firmware	All versions

Running on/with	Platform Versions
Netapp A320	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp C190 Firmware	All versions

Running on/with	Platform Versions
Netapp C190	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A220 Firmware	All versions

Running on/with	Platform Versions
Netapp A220	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas2720 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas2720	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas2750 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas2750	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A800 Firmware	All versions

Running on/with	Platform Versions
Netapp A800	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300e Firmware	All versions

Running on/with	Platform Versions
Netapp H300e	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500e Firmware	All versions

Running on/with	Platform Versions
Netapp H500e	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700e Firmware	All versions

Running on/with	Platform Versions
Netapp H700e	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610s Firmware	All versions

Running on/with	Platform Versions
Netapp H610s	All versions

Related CWEs

CWE-122

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (48)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2019/08/28/1

Source: secalert@redhat.com

ExploitMailing ListPatchThird Party Advisory

https://access.redhat.com/errata/RHSA-2020:0174

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0328

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0339

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/security/cve/cve-2019-14814

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14814

Source: secalert@redhat.com

ExploitIssue TrackingPatchThird Party Advisory

https://github.com/torvalds/linux/commit/7caac62ed598a196d6ddf8d9c121e12e082cac3a

Source: secalert@redhat.com

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3RUDQJXRJQVGHCGR4YZWTQ3ECBI7TXH/

Source: secalert@redhat.com

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4JZ6AEUKFWBHQAROGMQARJ274PQP2QP/

Source: secalert@redhat.com

Third Party Advisory

https://seclists.org/bugtraq/2019/Nov/11

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20191031-0005/

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/4157-1/

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/4157-2/

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/4162-1/

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/4162-2/

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/4163-1/

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/4163-2/

Source: secalert@redhat.com

Third Party Advisory

https://www.openwall.com/lists/oss-security/2019/08/28/1

Source: secalert@redhat.com

ExploitMailing ListPatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html