Bug 1775803 (CVE-2019-19039)

Summary:	CVE-2019-19039 kernel: information disclosure in __btrfs_free_extent in fs/btrfs/extent-tree.c
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, airlied, bdettelb, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jschorr, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, plougher, qzhao, rt-maint, rvrbovsk, steved, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-01-28 06:09:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1775804
Bug Blocks:	1775805

Description Guilherme de Almeida Suckevicz 2019-11-22 20:42:44 UTC

__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program.

Reference:
https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19039

Comment 1 Guilherme de Almeida Suckevicz 2019-11-22 20:43:14 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1775804]

Comment 2 Wade Mealing 2020-01-28 05:49:17 UTC

Another party  currently has this issue marked as DISPUTED in the NVD database.  

The reason that this is disputed is because the 'register' information is no different than any of the other warnings that show backtracer/register information to system logs.  See the Mitigation heading for information on how to prevent this on a system.

Comment 3 Wade Mealing 2020-01-28 05:54:51 UTC

Mitigation:

Its likely that this flaw will not end up being fixed, due to this being expected behavior.

If this behavior is not derirable, it  can be mitigated by explicitly setting the kernel parameter to restrict non privileged users  with the command:

sudo sysctl -w kernel.dmesg_restrict=1

And to make persistent between systme reboots.

echo 'kernel.dmesg_restrict=1' | sudo tee -a /etc/sysctl.conf