Heap-based buffer overflow in kernel
Priority MEDIUM 47CWE-122Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 21 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.
Summary
A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.
Why it matters now
EPSS 0.05877 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 7 advisoriesRed Hat: 21 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | kernel | all versions | — | No fix listed | CNA |
- kernel Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 3.0 to before 3.16.70; 3.17 to before 4.4.186; 4.5 to before 4.9.186; 4.10 to before 4.14.134; 4.15 to before 4.19.59; 4.20 to before 5.1.18 | Vulnerable | Linux |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 3.0 to before 3.16.70; 3.17 to before 4.4.186; 4.5 to before 4.9.186; 4.10 to before 4.14.134; 4.15 to before 4.19.59; 4.20 to before 5.1.18 Vulnerable ·Linux
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager_for_vmware_vsphere:*:*:*:*:*:*:*:* | 9.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* | 42.3 | Vulnerable | openSUSE |
- cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager_for_vmware_vsphere:*:*:*:*:*:*:*:* Versions 9.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* Versions 42.3 Vulnerable ·openSUSE
Remediation
Red Hat 7 advisories
- RHSA-2020:2289 Released 2020-05-26 · Red Hat rating Importantkernel security and bug fix update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) bpftool-3.10.0-957.54.1.el7, kernel-3.10.0-957.54.1.el7, kernel-abi-whitelists-3.10.0-957.54.1.el7 +8
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) kernel-tools-libs-devel-3.10.0-957.54.1.el7
- Red Hat Enterprise Linux Server EUS (v. 7.6) bpftool-3.10.0-957.54.1.el7, kernel-3.10.0-957.54.1.el7, kernel-abi-whitelists-3.10.0-957.54.1.el7 +11
- Red Hat Enterprise Linux Server Optional EUS (v. 7.6) kernel-debug-devel-3.10.0-957.54.1.el7, kernel-tools-libs-devel-3.10.0-957.54.1.el7
- Red Hat Virtualization 4.2 Hypervisor for RHEL 7.6 EUS kernel-devel-3.10.0-957.54.1.el7, perf-3.10.0-957.54.1.el7, python-perf-3.10.0-957.54.1.el7
- RHSA-2020:0174 Released 2020-01-21 · Red Hat rating Importantkernel-alt security and bug fix update
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) kernel-4.14.0-115.17.1.el7a, kernel-abi-whitelists-4.14.0-115.17.1.el7a, kernel-alt-4.14.0-115.17.1.el7a +8
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) kernel-debug-devel-4.14.0-115.17.1.el7a, kernel-tools-libs-devel-4.14.0-115.17.1.el7a
- RHSA-2019:3089 Released 2019-10-16 · Red Hat rating Importantkernel-rt security and bug fix update
- Red Hat Enterprise Linux Realtime (v. 7) kernel-rt-3.10.0-1062.4.1.rt56.1027.el7, kernel-rt-debug-3.10.0-1062.4.1.rt56.1027.el7, kernel-rt-debug-devel-3.10.0-1062.4.1.rt56.1027.el7 +4
- Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt-3.10.0-1062.4.1.rt56.1027.el7, kernel-rt-debug-3.10.0-1062.4.1.rt56.1027.el7, kernel-rt-debug-devel-3.10.0-1062.4.1.rt56.1027.el7 +7
Show 4 more Red Hat advisories
- RHSA-2019:3076 Released 2019-10-16 · Red Hat rating Importantkpatch-patch security update
- Red Hat Enterprise Linux Server (v. 7) kpatch-patch-3_10_0-1062-1-5.el7, kpatch-patch-3_10_0-1062_1_1-1-4.el7, kpatch-patch-3_10_0-1062_1_2-1-3.el7
- RHSA-2019:3055 Released 2019-10-16 · Red Hat rating Importantkernel security and bug fix update
- Red Hat Enterprise Linux Client (v. 7) bpftool-3.10.0-1062.4.1.el7, kernel-3.10.0-1062.4.1.el7, kernel-abi-whitelists-3.10.0-1062.4.1.el7 +8
- Red Hat Enterprise Linux Client Optional (v. 7) kernel-tools-libs-devel-3.10.0-1062.4.1.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) bpftool-3.10.0-1062.4.1.el7, kernel-3.10.0-1062.4.1.el7, kernel-abi-whitelists-3.10.0-1062.4.1.el7 +8
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-tools-libs-devel-3.10.0-1062.4.1.el7
- Red Hat Enterprise Linux Server (v. 7) bpftool-3.10.0-1062.4.1.el7, kernel-3.10.0-1062.4.1.el7, kernel-abi-whitelists-3.10.0-1062.4.1.el7 +11
- Red Hat Enterprise Linux Server Optional (v. 7) kernel-debug-devel-3.10.0-1062.4.1.el7, kernel-tools-libs-devel-3.10.0-1062.4.1.el7
- Red Hat Enterprise Linux Workstation (v. 7) bpftool-3.10.0-1062.4.1.el7, kernel-3.10.0-1062.4.1.el7, kernel-abi-whitelists-3.10.0-1062.4.1.el7 +8
- Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-tools-libs-devel-3.10.0-1062.4.1.el7
- RHSA-2019:2741 Released 2019-09-12 · Red Hat rating Importantkernel-rt security and bug fix update
- Red Hat Enterprise Linux Real Time (v. 8) kernel-rt-4.18.0-80.11.1.rt9.156.el8_0, kernel-rt-core-4.18.0-80.11.1.rt9.156.el8_0, kernel-rt-debug-4.18.0-80.11.1.rt9.156.el8_0 +7
- Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt-4.18.0-80.11.1.rt9.156.el8_0, kernel-rt-core-4.18.0-80.11.1.rt9.156.el8_0, kernel-rt-debug-4.18.0-80.11.1.rt9.156.el8_0 +9
- RHSA-2019:2703 Released 2019-09-12 · Red Hat rating Importantkernel security and bug fix update
- Red Hat CodeReady Linux Builder (v. 8) kernel-tools-libs-devel-4.18.0-80.11.1.el8_0
- Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-80.11.1.el8_0, kernel-4.18.0-80.11.1.el8_0, kernel-abi-whitelists-4.18.0-80.11.1.el8_0 +21
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2019:2703 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2019:2703 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2019:3055 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2019:3055 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2019:3055 |
| Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) | Fixed | RHSA-2020:2289 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2019:3055 |
| Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) | Fixed | RHSA-2020:2289 |
| Red Hat Enterprise Linux Real Time (v. 8) | Fixed | RHSA-2019:2741 |
| Red Hat Enterprise Linux Real Time for NFV (v. 8) | Fixed | RHSA-2019:2741 |
| Red Hat Enterprise Linux Realtime (v. 7) | Fixed | RHSA-2019:3089 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2019:3055, RHSA-2019:3076 |
| Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2020:2289 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2019:3055 |
| Red Hat Enterprise Linux Server Optional EUS (v. 7.6) | Fixed | RHSA-2020:2289 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2019:3055 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2019:3055 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) | Fixed | RHSA-2020:0174 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) | Fixed | RHSA-2020:0174 |
| Red Hat Enterprise Linux for Real Time for NFV (v. 7) | Fixed | RHSA-2019:3089 |
| Red Hat Virtualization 4.2 Hypervisor for RHEL 7.6 EUS | Fixed | RHSA-2020:2289 |
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise MRG 2
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3846
- 2026-10-03 Alias added: GHSA-3fcq-fcfj-jgfq
References
Patch 2
Advisory 25
- FEDORA-2019-7ec378191e
- FEDORA-2019-f40bd7826f
- DSA-4465
- [debian-lts-announce] 20190617 [SECURITY] [DLA 1823-1] linux security update
- [debian-lts-announce] 20190618 [SECURITY] [DLA 1824-1] linux-4.9 security update
- openSUSE-SU-2019:1570
- openSUSE-SU-2019:1571
- 20190618 [SECURITY] [DSA 4465-1] linux security update
- openSUSE-SU-2019:1579
- https://security.netapp.com/advisory/ntap-20190710-0002/
- http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- USN-4093-1
- USN-4094-1
- USN-4095-2
- USN-4095-1
- http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
- USN-4117-1
- USN-4118-1
- RHSA-2019:2703
- RHSA-2019:2741
- RHSA-2019:3076
- RHSA-2019:3055
- RHSA-2019:3089
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
- RHSA-2020:0174
Sources
- CVE-2019-3846 · CVE Program
- CVE-2019-3846 · NVD
- FIRST EPSS
- GHSA-3fcq-fcfj-jgfq · GitHub Advisory Database · CC BY 4.0
- CVE-2019-3846 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences