Bugzilla – Bug 1163927
VUL-0: CVE-2019-14559: ovmf: memory leak in ArpOnFrameRcvdDpc by sending invalid ARP packets
Last modified: 2020-11-03 14:23:58 UTC
CVE-2019-14559 A memory leak was discovered in NetworkPkg/ArpDxe in function ArpOnFrameRcvdDpc(), because of an error condition that is not correctly handled and does not signal the recycleEvent signal before continuing the reception of packets. An attacker can use this flaw to cause memory exhaustion. References: https://bugzilla.redhat.com/show_bug.cgi?id=1758601 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14559 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-14559.html
Tracked as affected the following codestreams: SLE12-SP2,3,4 SLE15
Detailed information regarding the issue and instruction to reproduce using scapy at [1] in comments 2 and 3 [1] https://bugzilla.tianocore.org/show_bug.cgi?id=2031
Found a related patch for Ip4Dxe was committed recently. https://github.com/tianocore/edk2/commit/578bcdc2605e3438b9cbdac4e68339f90f5bf8af
There are several upstream bugs sharing the same CVE id: https://bugzilla.tianocore.org/show_bug.cgi?id=1610 https://bugzilla.tianocore.org/show_bug.cgi?id=2032 https://bugzilla.tianocore.org/show_bug.cgi?id=2174
The general upstream bug tracker: https://bugzilla.tianocore.org/show_bug.cgi?id=2550
There is no patch for 2032 and 2174 yet. Will backport the patches for 2031 and 1610 first and wait for the pending upstream bugs.
The fix for 1610 and 2031 is submitted. Will backport the fix for 2032 and 2174 when upstream provides the patch.
SUSE-SU-2020:0495-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1077330,1094291,1163927,1163959,1163969 CVE References: CVE-2018-0739,CVE-2019-14559,CVE-2019-14563,CVE-2019-14575 Sources used: SUSE OpenStack Cloud 7 (src): ovmf-2015+git1462940744.321151f-19.10.3 SUSE Linux Enterprise Server for SAP 12-SP2 (src): ovmf-2015+git1462940744.321151f-19.10.3 SUSE Linux Enterprise Server 12-SP2-LTSS (src): ovmf-2015+git1462940744.321151f-19.10.3 SUSE Linux Enterprise Server 12-SP2-BCL (src): ovmf-2015+git1462940744.321151f-19.10.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:0568-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1153072,1163927,1163959,1163969 CVE References: CVE-2019-14553,CVE-2019-14559,CVE-2019-14563,CVE-2019-14575 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): ovmf-2017+git1510945757.b2662641d5-5.29.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:0314-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1153072,1163927,1163959,1163969 CVE References: CVE-2019-14553,CVE-2019-14559,CVE-2019-14563,CVE-2019-14575 Sources used: openSUSE Leap 15.1 (src): ovmf-2017+git1510945757.b2662641d5-lp151.11.3.1
SUSE-SU-2020:0699-1: An update that fixes four vulnerabilities is now available. Category: security (low) Bug References: 1153072,1163927,1163959,1163969 CVE References: CVE-2019-14553,CVE-2019-14559,CVE-2019-14563,CVE-2019-14575 Sources used: SUSE Linux Enterprise Server 12-SP5 (src): ovmf-2017+git1510945757.b2662641d5-3.23.1 SUSE Linux Enterprise Server 12-SP4 (src): ovmf-2017+git1510945757.b2662641d5-3.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
The patches for 2032 and 2174 are merged into edk2 git. 2032: https://github.com/tianocore/edk2/commit/65c73df44c61235ede84c5aa1d2eab6650844966 2174: https://github.com/tianocore/edk2/commit/9c20342eed70ec99ec50cd73cb81804299f05403 https://github.com/tianocore/edk2/commit/4deef2d865efdc61d1a53ad7bd48f9dd42560b45
All related patches were submitted.
SUSE-SU-2020:1065-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1163927 CVE References: CVE-2019-14559 Sources used: SUSE Linux Enterprise Server 12-SP5 (src): ovmf-2017+git1510945757.b2662641d5-3.26.1 SUSE Linux Enterprise Server 12-SP4 (src): ovmf-2017+git1510945757.b2662641d5-3.26.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:1125-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1163927 CVE References: CVE-2019-14559 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): ovmf-2017+git1510945757.b2662641d5-5.32.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:0622-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1163927 CVE References: CVE-2019-14559 Sources used: openSUSE Leap 15.1 (src): ovmf-2017+git1510945757.b2662641d5-lp151.11.6.1
Done
SUSE-SU-2020:3126-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1163927,1175476 CVE References: CVE-2019-14559,CVE-2019-14562 JIRA References: Sources used: SUSE OpenStack Cloud 7 (src): ovmf-2015+git1462940744.321151f-19.15.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): ovmf-2015+git1462940744.321151f-19.15.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): ovmf-2015+git1462940744.321151f-19.15.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): ovmf-2015+git1462940744.321151f-19.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.