Bug 1777455 (CVE-2019-18811)

Summary:	CVE-2019-18811 kernel: memory leak in sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bdettelb, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mjg59, mlangsdo, nmurray, qzhao, rt-maint, rvrbovsk, steved, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel’s sof_set_get_large_ctrl_data function, in the way it handled memory cleanup in a specific error path. A local attacker could use this flaw to crash the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-25 22:12:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1777456, 1807098
Bug Blocks:	1777495

Description Dhananjay Arunesh 2019-11-27 15:39:16 UTC

A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures.

Reference:
https://github.com/torvalds/linux/commit/45c1380358b12bf2d1db20a5874e9544f56b34ab

Comment 1 Dhananjay Arunesh 2019-11-27 15:39:44 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1777456]

Comment 2 Petr Matousek 2020-02-25 15:27:13 UTC

Mitigation:

As the snd-sof module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions:

# echo "install snd-sof /bin/true" >> /etc/modprobe.d/disable-snd-sof.conf

The system will need to be restarted if the snd-sof module is already loaded. In most circumstances, the snd-sof kernel module will be unable to be unloaded while the device is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

Comment 5 errata-xmlrpc 2021-05-18 13:19:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578