CVE-2019-14895
A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.76%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 7.76% probability · 95th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-122, CWE-787
- Affected
- linux/linux kernel · debian/debian linux · canonical/ubuntu linux · fedoraproject/fedora · opensuse/leap
- Source
- secalert@redhat.com
EPSS 7.8% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.htmlMailing List, Third Party Advisory
- http://packetstormsecurity.com/files/155879/Kernel-Live-Patch-Security-Notice-LSN-0061-1.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.htmlThird Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2020:0328Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0339Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0374Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0375Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0543Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0592Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0609Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0653Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0661Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0664Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14895Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4ISVNIC44SOGXTUBCIZFSUNQJ5LRKNZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MN6MLCN7G7VFTSXSZYXKXEFCUMFBUAXQ/
- https://usn.ubuntu.com/4225-1/Third Party Advisory
- https://usn.ubuntu.com/4225-2/Third Party Advisory
- https://usn.ubuntu.com/4226-1/Third Party Advisory
- https://usn.ubuntu.com/4227-1/Third Party Advisory
- https://usn.ubuntu.com/4227-2/Third Party Advisory
- https://usn.ubuntu.com/4228-1/Third Party Advisory
- https://usn.ubuntu.com/4228-2/Third Party Advisory
- https://www.openwall.com/lists/oss-security/2019/11/22/2Mailing List, Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.htmlMailing List, Third Party Advisory
- http://packetstormsecurity.com/files/155879/Kernel-Live-Patch-Security-Notice-LSN-0061-1.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.htmlThird Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2020:0328Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.