Bug 1746725 (CVE-2019-15504)

Summary: CVE-2019-15504 kernel: double free in drivers/net/wireless/rsi/rsi_91x_usb.c via crafted USB device
Product: [Other] Security Response Reporter: Dhananjay Arunesh <darunesh>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, airlied, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, fhrbata, hdegoede, hkrzesin, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, mchehab, mickygough, mjg59, mlangsdo, nmurray, plougher, rvrbovsk, steved, torez, williams, wmealing, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-12-04 08:02:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1746726    
Bug Blocks: 1746727    

Description Dhananjay Arunesh 2019-08-29 07:29:07 UTC 
A vulnerability was found in drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).

Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git/commit/?id=8b51dc7291473093c821195c4b6af85fadedbc2f
Comment 1 Dhananjay Arunesh 2019-08-29 07:29:44 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1746726]
Comment 2 Wade Mealing 2019-12-04 08:05:48 UTC 
Note:

This flaw is classified in the attack vector (local) that the device appears to the kernel.  Local attacks would not be considered remote attacks if the attacker must first ssh in.  

Red Hat Enterprise Enterprise Linux does not ship a kernel with this network device enabled.