An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.
4.4.0-177.2074.4.0-1105.1164.15.0-1065.69~16.04.14.15.0-1077.824.15.0-1060.644.15.0-96.97~16.04.14.10.0-14.16~16.04.14.10.0-19.21~16.04.14.10.0-20.22~16.04.14.10.0-21.23~16.04.14.10.0-22.24~16.04.14.10.0-24.28~16.04.14.10.0-26.30~16.04.14.11.0-13.19~16.04.14.11.0-14.20~16.04.14.13.0-16.19~16.04.3+13 more4.4.0-1069.764.15.0-1037.41~16.04.14.4.0-1131.140Exploitability
AV:AAC:HPR:NUI:RScope
S:UImpact
C:HI:HA:HCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H