CVE-2019-17133: Buffer Overflow
A vulnerability was found in the Linux kernel's generic WiFi ESSID handling implementation. The flaw allows a system to join a wireless network where the ESSID is longer than the maximum length of 32 characters, which can cause the system to crash or execute code.
Other sources
A vulnerability was found in the Linux kernels generic wifi management system in the function cfg80211mgdwextgiwessid. Many of the wifi drivers use this software and if an attacker could trick or coerce a system to joining a wifi network with an essid longer than the standard could create a situation which could the essid data could corrupt kernel stack memory and possibly escalate privileges.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4ac2813cc867ae563a1ba5a9414bfb554e5796fa
— Red Hat
In the Linux kernel through 5.3.2, cfg80211mgdwextgiwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.
Linux Kernel is vulnerable to a buffer overflow, caused by improper bounds checking by the cfg80211mgdwextgiwessid functions in net/wireless/wext-sme.c. By sending an overly long long SSID IE, a remote attacker could overflow a buffer and execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-17133?
CVE-2019-17133 has been classified as a high severity vulnerability due to its potential to cause system crashes and arbitrary code execution.
How do I fix CVE-2019-17133?
To fix CVE-2019-17133, you should update the Linux kernel to remedial versions which include the fix for this vulnerability.
Which Linux distributions are affected by CVE-2019-17133?
CVE-2019-17133 affects various Linux distributions, including specific versions of Red Hat, Debian, and Ubuntu.
What impact does CVE-2019-17133 have on a system?
CVE-2019-17133 can enable an attacker to crash the system or execute arbitrary code by exploiting the vulnerability in WiFi ESSID handling.
Is CVE-2019-17133 being actively exploited?
There is no public evidence confirming that CVE-2019-17133 is actively being exploited in the wild, but it remains a critical vulnerability that should be addressed promptly.