Bug 1746725 (CVE-2019-15504)

Summary:	CVE-2019-15504 kernel: double free in drivers/net/wireless/rsi/rsi_91x_usb.c via crafted USB device
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, fhrbata, hdegoede, hkrzesin, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, mchehab, mickygough, mjg59, mlangsdo, nmurray, plougher, rvrbovsk, steved, torez, williams, wmealing, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-12-04 08:02:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1746726
Bug Blocks:	1746727

Description Dhananjay Arunesh 2019-08-29 07:29:07 UTC

A vulnerability was found in drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).

Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git/commit/?id=8b51dc7291473093c821195c4b6af85fadedbc2f

Comment 1 Dhananjay Arunesh 2019-08-29 07:29:44 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1746726]

Comment 2 Wade Mealing 2019-12-04 08:05:48 UTC

Note:

This flaw is classified in the attack vector (local) that the device appears to the kernel.  Local attacks would not be considered remote attacks if the attacker must first ssh in.  

Red Hat Enterprise Enterprise Linux does not ship a kernel with this network device enabled.