Bugzilla – Bug 1157319
VUL-1: DISPUTED: CVE-2019-19055: kernel-source: memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c
Last modified: 2022-12-23 11:43:50 UTC
CVE-2019-19055 A memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering nl80211hdr_put() failures, aka CID-1399c59fa929. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19055 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19055.html https://github.com/torvalds/linux/commit/1399c59fa92984836db90538cf92397fe7caaa57 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19055
If I understand the code correctly the only case where this might be triggered is if the newly/successfully allocated msg somehow has no room for the header in the next function call. Could someone confirm that this understanding is correct and that this is also a rejection candidate.
Only kernel this might be relevant for seems to be SLE15-SP2.
Yes, the code path is something like that, nl80211hdr_put() calls genlmsg_put() that calls nlmsg_put(). In anyway, the fix was already included in SLE15-SP2 via git-fixes backport. I'll update the patch reference tag. Reassigned back to security team.
done