Bug 1681007 (CVE-2019-9003)

Summary:	CVE-2019-9003 kernel: use-after-free and OOPS in drivers/char/ipmi/ipmi_msghandler.c
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jforbes, pmatouse, tcamuso, vdronov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free and OOPs flaw was found in the Linux kernel's drivers/char/ipmi/ipmi_msghandler.c code. By arranging certain simultaneous execution of the code accessing IPMI device files, an attacker can cause a denial of service (DoS) attack.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-27 03:26:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1681008, 1684175, 1684176
Bug Blocks:	1681052

Description msiddiqu 2019-02-25 15:51:54 UTC

It was found that in the Linux kernel attackers can trigger a use-after-free and OOPS in the drivers/char/ipmi/ipmi_msghandler.c code by arranging certain simultaneous execution of the code accessing IPMI device files, which in turn can lead to a denial-of-service (DoS).

References:

https://lore.kernel.org/lkml/1547616802-31868-1-git-send-email-yangyingliang@huawei.com/T/#u

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.5

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=77f8269606bf95fcb232ee86f6da80886f1dfae8

Comment 1 msiddiqu 2019-02-25 15:52:16 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1681008]

Comment 2 Justin M. Forbes 2019-02-25 23:12:06 UTC

This was fixed for Fedora with the 4.20.5 stable updates