Bug 1715554 (CVE-2019-12382)

Summary: CVE-2019-12382 kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service
Product: [Other] Security Response Reporter: msiddiqu
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, airlied, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jkacur, john.j5live, jonathan, josef, jross, jstancek, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, matt, mchehab, mcressma, mjg59, mlangsdo, mmilgram, nmurray, plougher, rt-maint, rvrbovsk, steved, williams, wmealing
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s implementation of Extended Display Identification Data (EDID) technology. A firmware identifier string is duplicated with the kstrdup function, and the allocation may fail under very low memory conditions. An attacker could abuse this flaw by causing a Denial of Service and crashing the system.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-31 22:34:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1715556, 1732708, 1732709, 1732710, 1732711, 1732712, 1828301, 1828303    
Bug Blocks: 1715563    

Description msiddiqu 2019-05-30 16:20:03 UTC 
An issue was discovered in the Linux kernels implementation of Extended Display Identification Data (EDID) technology.
An attacker with local access could cause a system under severe memory pressure to create a null pointer dereference when plugging in a monitor.


An firmware identifier string is duplicated with the kstrdup function, and the allocation may fail under very low memory conditions. This may allow an attacker to crash the system  causing a denial of service (NULL pointer dereference)

The conditions under which this flaw would take place are unlikely and it likely that the system OOMkiller would free available memory before the low memory condition to exploit this flaw is met.

Upstream patch: 

https://cgit.freedesktop.org/drm/drm-misc/commit/?id=9f1f1a2dab38d4ce87a13565cf4dc1b73bef3a5f

References:  

https://lkml.org/lkml/2019/5/24/843
Comment 1 msiddiqu 2019-05-30 16:20:31 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1715556]
Comment 6 errata-xmlrpc 2020-03-31 19:11:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1016 https://access.redhat.com/errata/RHSA-2020:1016
Comment 7 errata-xmlrpc 2020-03-31 19:20:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1070 https://access.redhat.com/errata/RHSA-2020:1070
Comment 8 Product Security DevOps Team 2020-03-31 22:34:16 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-12382
Comment 12 errata-xmlrpc 2020-06-11 02:10:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2020:2522 https://access.redhat.com/errata/RHSA-2020:2522