Bug 1666106 (CVE-2018-19985)

Summary:	CVE-2018-19985 kernel: oob memory read in hso_probe in drivers/net/usb/hso.c
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jforbes, vdronov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 4.20	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel in the function hso_probe() which reads if_num value from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hso_probe() or hso_get_config_data(). An attacker with a forged USB device and physical access to a system (needed to connect such a device) can cause a system crash and a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-06 00:51:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1666107, 1666659, 1666660, 1666661, 1666662, 1666663
Bug Blocks:	1666108

Description Laura Pardo 2019-01-14 22:44:37 UTC

A flaw was found in the Linux kernel in the function hso_probe() which reads if_num value from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hso_probe() or hso_get_config_data(). An attacker with forged USB device with a physical access to a system (needed to connect such a device) can cause a system crash and a denial-of-service.

References:

https://marc.info/?t=154461511700001&r=1&w=2

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5146f95df782b0ac61abde36567e718692725c89

Comment 1 Laura Pardo 2019-01-14 22:44:50 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1666107]

Comment 2 Justin M. Forbes 2019-01-15 13:54:46 UTC

This was fixed for Fedora with the 4.19.13 stable kernel update.

Comment 6 errata-xmlrpc 2019-11-05 20:35:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3309 https://access.redhat.com/errata/RHSA-2019:3309

Comment 7 errata-xmlrpc 2019-11-05 21:05:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3517 https://access.redhat.com/errata/RHSA-2019:3517

Comment 8 Product Security DevOps Team 2019-11-06 00:51:42 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-19985

Comment 9 errata-xmlrpc 2020-03-31 19:11:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1016 https://access.redhat.com/errata/RHSA-2020:1016

Comment 10 errata-xmlrpc 2020-03-31 19:20:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1070 https://access.redhat.com/errata/RHSA-2020:1070