Bugzilla – Bug 1157319
VUL-1: DISPUTED: CVE-2019-19055: kernel-source: memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c
Last modified: 2022-12-23 11:43:50 UTC
A memory leak in the nl80211_get_ftm_responder_stats() function in
net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attackers to
cause a denial of service (memory consumption) by triggering nl80211hdr_put()
failures, aka CID-1399c59fa929.
If I understand the code correctly the only case where this might be triggered is if the newly/successfully allocated msg somehow has no room for the header in the next function call.
Could someone confirm that this understanding is correct and that this is also a rejection candidate.
Only kernel this might be relevant for seems to be SLE15-SP2.
Yes, the code path is something like that, nl80211hdr_put() calls genlmsg_put() that calls nlmsg_put().
In anyway, the fix was already included in SLE15-SP2 via git-fixes backport.
I'll update the patch reference tag.
Reassigned back to security team.