Bug 1451399 (CVE-2017-8924)

Summary:	CVE-2017-8924 kernel: Information leak in completion handler in edge_bulk_in_callback function
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	agordeev, aquini, bhu, dhoward, dominik.mierzejewski, esammons, fhrbata, gansalmon, hwkernel-mgr, iboverma, ichavero, itamar, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, lwang, madhu.chinakonda, matt, mchehab, mcressma, mguzik, nmurray, pholasek, plougher, rt-maint, rvrbovsk, vdronov, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-05-31 11:30:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1457217
Bug Blocks:	1451400

Description Andrej Nemec 2017-05-16 14:50:32 UTC

The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow.

Upstream patch:

https://github.com/torvalds/linux/commit/654b404f2a222f918af9b0cd18ad469d0c941a8e

Comment 1 Vladis Dronov 2017-05-31 11:13:39 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1457217]

Comment 4 Vladis Dronov 2017-05-31 11:30:47 UTC

Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates of the Red Hat products. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 5 Justin M. Forbes 2018-01-29 17:26:31 UTC

This was fixed for Fedora with the 4.11 rebases.