What’s Vulnerable › Vulnerabilities

CVE-2019-14814

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-09-20 · updated 2026-06-17
• Weakness: CWE-122

Description

There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 19.04
• Debian Linux: 8.0
• Linux kernel: from 3.7 before 3.16.74; from 3.17 before 4.4.194; from 4.5 before 4.9.194; from 4.10 before 4.14.146; from 4.15 before 4.19.75; from 4.20 before 5.2.17 — fixed in 3.16.74, 4.14.146, 4.19.75, 4.4.194, 4.9.194, 5.2.17
• NetApp A220 Firmware: all versions
• NetApp A320 Firmware: all versions
• NetApp A700S Firmware: all versions
• NetApp A800 Firmware: all versions
• NetApp C190 Firmware: all versions
• NetApp Data Availability Services: all versions
• NetApp Fas2720 Firmware: all versions
• NetApp Fas2750 Firmware: all versions
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H610S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Hci Management Node: all versions
• NetApp, Inc. NetApp Service Processor: all versions
• NetApp Solidfire: all versions
• NetApp Steelstore Cloud Integrated Storage: all versions
• openSUSE Leap: 15.0, 15.1
• Red Hat Enterprise Linux: 5.0, 6.0, 7.0, 8.0
• RedHat Enterprise Linux Eus: 8.1, 8.2, 8.4
• RedHat Enterprise Linux For Real Time: 8
• RedHat Enterprise Linux For Real Time For Nfv: 8
• RedHat Enterprise Linux For Real Time For Nfv Tus: 8.2, 8.4

How to fix

Upgrade to a fixed version: Linux kernel 3.16.74, 4.14.146, 4.19.75, 4.4.194. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
• http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
• http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
• http://www.openwall.com/lists/oss-security/2019/08/28/1
• https://access.redhat.com/errata/RHSA-2020:0174
• https://access.redhat.com/errata/RHSA-2020:0328
• https://access.redhat.com/errata/RHSA-2020:0339
• https://access.redhat.com/security/cve/cve-2019-14814
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14814
• https://github.com/torvalds/linux/commit/7caac62ed598a196d6ddf8d9c121e12e082cac3a
• https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html

Get alerted when CVE-2019-14814 or the next vulnerability affects your stack