Bug 1751393 (CVE-2019-16089)

Summary:	CVE-2019-16089 kernel: Improper return check in nbd_genl_status function in drivers/block/nbd.c
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, airlied, bhu, blc, bmasney, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mjg59, mlangsdo, nmurray, ptalbert, rt-maint, rvrbovsk, steved, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An improper return check flaw was found in the Linux kernel’s network block device driver functionality when the user call query to check the status of existing network block devices. This flaw allows a local user to crash the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-27 10:55:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1751394, 1816335, 1816336, 1911200
Bug Blocks:	1751395

Description Pedro Sampaio 2019-09-11 22:07:08 UTC

An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does not check the nla_nest_start_noflag return value.

References:

https://lore.kernel.org/patchwork/patch/1106884/

Comment 1 Pedro Sampaio 2019-09-11 22:07:43 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1751394]

Comment 3 Alex 2020-03-23 19:37:48 UTC

Mitigation:

To mitigate this issue, prevent module nbd from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.

Comment 8 Petr Matousek 2020-03-25 12:16:52 UTC

Statement:

The impact of this issue is Low, because attack is specific for certain network block device usage and could be triggered only by local user with access to the device (resulting denial-of-service) and attack is complex, because could happen only if specific condition (out of memory) at the moment of the attack is met.