Bug 1781899 (CVE-2019-19378)

Summary:	CVE-2019-19378 kernel: out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, airlied, bdettelb, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jschorr, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, qzhao, rt-maint, rvrbovsk, steve.beattie, steved, williams, wmealing
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the BTRFS implementation in the Linux kernel. A slab-out-of-bounds write occurs when an attacker can mount a specially crafted BTRFS disk or disk image.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-06 16:31:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1781900
Bug Blocks:	1781901

Description Guilherme de Almeida Suckevicz 2019-12-10 20:49:38 UTC

A flaw was found in the Linux kernels BTRFS implementation which could allow for a slab-out-of-bounds write when an attacker is able to mount a specifically crafted BTRFS disk or disk image.

The attacker must create an image with unexpected values to convince the kernel to write disk metadata information in the wrong location.

This could allow for memory corruption or possibly privilege escalation.

Reference:
https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19378

Comment 1 Guilherme de Almeida Suckevicz 2019-12-10 20:52:12 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1781900]

Comment 3 Wade Mealing 2020-04-01 06:34:09 UTC

This flaw is rated as moderate, as it requires a local user (usually privileged) to mount a corrupt filesystem.

Comment 5 Wade Mealing 2020-04-05 23:38:50 UTC

Mitigation:


As the BTRFS module will be auto-loaded when required, its use can be disabled  by preventing the module from loading with the following instructions:

# echo "install btrfs /bin/true" >> /etc/modprobe.d/disable-btrfs.conf

The system will need to be restarted if the BTRFS modules are loaded, it may be possible to unload them. In most circumstances, the BTRFS kernel modules will be unable to be unloaded while any BTRFS filesystems are mounted or in use.

If the system requires this module to work correctly, this mitigation may not be suitable.

If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

Comment 7 Petr Matousek 2020-04-16 14:12:54 UTC

Statement:

This issue is considered as having Low impact because it needs physical access to trigger and it's also in Technology Preview functionality. For more information regarding BTRFS support in Red Hat Enterprise Linux 6 and 7 refer to https://access.redhat.com/solutions/197643 .

Comment 8 Product Security DevOps Team 2020-05-06 16:31:53 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19378