Bug 1784141 (CVE-2019-19318)

Summary:	CVE-2019-19318 kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bdettelb, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mjg59, mlangsdo, nmurray, qzhao, rkeshri, rt-maint, rvrbovsk, steved, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free flaw was found in rwsem_can_spin_on_owner in the kernel/locking/rwsem.c function in the Linux kernel’s synchronization mechanism. This flaw allows a local attacker with root privileges to cause a denial of service. This vulnerability could also lead to a kernel information leak issue.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-25 22:15:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1784143, 1835776
Bug Blocks:	1784142

Description Guilherme de Almeida Suckevicz 2019-12-16 19:10:06 UTC

A use-after-free flaw was found in rwsem_can_spin_on_owner in kernel/locking/rwsem.c in Linux kernel synchronization mechanism. This flaw can allow a local attacker with root privilege to cause a denial of service (DoS). This vulnerability could even lead to a kernel information leak problem.

For writer, the owner value is cleared on unlock. For reader, it is left intact on unlock for providing better debugging aid on crash dump and the unlock of one reader may not mean the lock is free.

As a result, the owner_on_cpu() shouldn't be used on read-owner as the task pointer value may not be valid and the task structure might have been freed. That is the case in rwsem_can_spin_on_owner() where the following use-after-free error from KASAN may appear under certain circumstances:

  BUG: KASAN: use-after-free in rwsem_down_write_slowpath
  (/home/miguel/kernel/linux/kernel/locking/rwsem.c:669
  /home/miguel/kernel/linux/kernel/locking/rwsem.c:1125)

Reference:
https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19318
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg2056632.html

Comment 1 Guilherme de Almeida Suckevicz 2019-12-16 19:10:53 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1784143]

Comment 7 Rohit Keshri 2020-05-14 13:39:03 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 9 Justin M. Forbes 2020-10-08 19:04:54 UTC

This was fixed for Fedora with the 5.3.6 stable kernel updates.