Bug 1783434 (CVE-2019-19523)

Summary: CVE-2019-19523 kernel: use-after-free caused by a malicious USB device in the drivers/usb/misc/adutux.c driver
Product: [Other] Security Response Reporter: msiddiqu
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, airlied, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, qzhao, rt-maint, rvrbovsk, steved, torez, williams, wmealing
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s implementation for ADU devices from Ontrak Control Systems, where an attacker with administrative privileges and access to a local account could pre-groom the memory and physically disconnect or unload a module. The attacker must be able to access either of these two events to trigger the use-after-free, and then race the access to the use-after-free, to create a situation where key USB structs can be manipulated into corrupting memory.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-09-29 21:59:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1798820, 1798821, 1798822, 1798823, 1798824, 1798825, 1798826, 1888704, 1900751    
Bug Blocks: 1783438    

Comment 1 Justin M. Forbes 2019-12-16 16:44:58 UTC
This is fixed for Fedora with the 5.3.7 stable kernel update.

Comment 3 Wade Mealing 2020-02-06 04:49:30 UTC
A flaw was found in the Linux kernels implementation for ADU devices from Ontrak Control Systems, where  an attacker a local account to pre-groom the memory and the ability to physically (ability to unplug) disconnect or unload a module (administrative privileges).  The attacker must be able to trigger either of these two events to trigger the use-after-free, and then race the access to the use-after-free to create a situation where key usb structs can be manipulated into corrupting memory.

Comment 4 Wade Mealing 2020-02-06 05:00:14 UTC
Because of the physical/administrative priv requirement, This likely doesn't qualify for an important fix, dropping it to moderate. I think it probably should get fixed but its not urgently related.  

I'd be perfectly fine with having this module disabled or auto-blacklisted so it can't be loaded on any system without admin intervention. I really do not know how many customers we'd have using this module.  Feel free to drop a comment in this bz if you are.


Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=44efc269db7929f6275a1fa927ef082e533ecde0

References: 

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.7
http://seclists.org/oss-sec/2019/q4/115
https://www.openwall.com/lists/oss-security/2019/12/03/4

Comment 6 Wade Mealing 2020-02-06 05:09:02 UTC
Mitigation:


As the system module will be auto-loaded when a device that uses the driver is attached (via USB), its use can be disabled  by preventing the module from loading with the following instructions:

# echo "install adutux /bin/true" >> /etc/modprobe.d/disable-adutux.conf
 
The system will need to be restarted if the adutux module are loaded. In most circumstances, the kernel modules will be unable to be unloaded while any hardware is in use.

If the system requires this module to work correctly, this mitigation may not be suitable.

If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

Comment 7 Wade Mealing 2020-02-06 05:15:41 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1798820]

Comment 12 errata-xmlrpc 2020-09-29 18:58:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4062 https://access.redhat.com/errata/RHSA-2020:4062

Comment 13 errata-xmlrpc 2020-09-29 20:52:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4060 https://access.redhat.com/errata/RHSA-2020:4060

Comment 14 Product Security DevOps Team 2020-09-29 21:59:10 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19523

Comment 31 errata-xmlrpc 2021-05-18 13:19:44 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578

Comment 32 errata-xmlrpc 2021-05-18 14:40:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1739 https://access.redhat.com/errata/RHSA-2021:1739