Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 8 May 2020 18:38:08 +0800
From: qing xu <>
Subject: Linux kernel: two buffer overflow in the marvell wifi driver

There are two buffer overflows in marvell wifi chip driver in Linux kernel
which cause a denial of service(system crash) or possibly execute arbitrary

[1]CVE-2020-12653:The mwifiex_cmd_append_vsie_tlv() in
drivers/net/wireless/marvell/mwifiex/scan.c calls memcpy() without checking
the destination size may trigger a buffer overflower, which a local user
could use to cause denial of service or the execution of arbitrary code.

[2]CVE-2020-12654:mwifiex_ret_wmm_get_status() in
drivers/net/wireless/marvell/mwifiex/wmm.c calls memcpy() without checking
the destination size.Since the source is given from remote AP which
contains illegal wmm elements , this may trigger a heap buffer overflow.


This issue was discovered by ADLab of Venustech

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.