Bug 1745514 (CVE-2019-15215)

Summary:	CVE-2019-15215 kernel: use after free in drivers/media/usb/cpia2/cpia2_usb.c driver
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, plougher, rt-maint, rvrbovsk, steved, williams, wmealing
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free vulnerability was found in the Linux kernel's cpia2_usb driver. An attacker must have physical access to the system to utilize a malicious USB device to trigger the disconnect() functionality which is required to trigger this flaw. A local account is also required to take advantage of the use-after-free memory condition. System availability is the highest threat from this vulnerability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-02-24 09:49:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1745515
Bug Blocks:	1745537

Description Dhananjay Arunesh 2019-08-26 10:05:01 UTC

A vulnerability was found in the Linux kernel. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver. The attacker must have physical access to trigger the disconnect() functionality which is required to trigger this flaw and a local account to take advantage of the use-after-free memory condition.

Reference:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.6
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eff73de2b1600ad8230692f00bc0ab49b166512a
https://syzkaller.appspot.com/bug?id=b68d3c254cf294f8a802582094fa3251d6de5247

Comment 1 Dhananjay Arunesh 2019-08-26 10:05:35 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1745515]

Comment 2 Justin M. Forbes 2019-08-26 13:08:27 UTC

This was fixed for Fedora with the 5.2.6 stable update

Comment 7 Product Security DevOps Team 2020-02-24 09:49:33 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-15215

Comment 9 Eric Christensen 2020-02-27 14:22:13 UTC

Mitigation:

As the cpia2 module will be auto-loaded when required, its use can be disabled  by preventing the module from loading with the following instructions:

# echo "install cpia2 /bin/true" >> /etc/modprobe.d/disable-cpia2.conf 
 
The system will need to be restarted if the cpia2 modules are loaded. In most circumstances, the cpia2 kernel modules will be unable to be unloaded while the hardware is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.