Bug 1746769 (CVE-2019-15117)

Summary:	CVE-2019-15117 kernel: out of bounds memory access in parse_audio_mixer_unit in sound/usb/mixer.c
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bdettelb, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mjg59, mlangsdo, nmurray, pmatouse, rt-maint, rvrbovsk, steved, torez, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An out of bounds (OOB) memory access flaw was found in the Linux kernel's ALSA subsystem. This could allow a local attacker to crash the system or leak kernel internal information.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-27 10:49:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1746770, 1807791, 1807792
Bug Blocks:	1746772

Description Dhananjay Arunesh 2019-08-29 08:53:35 UTC

A vulnerability was found in parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel mishandles a short descriptor, leading to out-of-bounds memory access.

Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git/commit/?id=daac07156b330b18eb5071aec4b3ddca1c377f2c
https://lore.kernel.org/lkml/20190814023625.21683-1-benquike@gmail.com/

Comment 1 Dhananjay Arunesh 2019-08-29 08:54:12 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1746770]

Comment 2 Justin M. Forbes 2019-08-29 12:04:06 UTC

This was fixed for Fedora with the 5.2.10 stable update.

Comment 7 Rohit Keshri 2020-02-27 09:45:04 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.