Bug 1786164 (CVE-2019-19768)

Summary:	CVE-2019-19768 kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, airlied, asavkov, bdettelb, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, joe.lawrence, john.j5live, jonathan, josef, jpoimboe, jross, jschorr, jshortt, jstancek, jthierry, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, qzhao, rhandlin, rt-maint, rvrbovsk, steved, surpatil, tcrider, williams, wmealing, ycote
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free vulnerability was found in the Linux kernel’s implementation of blktrace in the __blk_add_trace function. A local attacker with permissions to run block trace instructions against a device can create a situation where the core block_trace object is used after it is freed. The attacker can pre-groom memory to race this use-after-free to create a condition where the memory is corrupted and cause privilege escalation. The ability to create this condition requires elevated privileges, and it has been decided that this change in Red Hat Enterprise Linux 5 and 6 would risk introducing possible regressions and will not be backported.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-04-28 16:35:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1786166, 1798306, 1798307, 1798308, 1798309, 1798310, 1798311, 1798312, 1798313, 1798314, 1798316, 1798317, 1798318, 1798319, 1798320, 1798321, 1798322, 1798323, 1798324, 1798325, 1798326, 1798327, 1798328, 1798329, 1798330, 1798331, 1798332, 1798333, 1798334, 1798335, 1798337, 1798338, 1798339, 1804310, 1804318, 1806367, 1806368, 1806369, 1806370, 1806393
Bug Blocks:	1786167

Description Guilherme de Almeida Suckevicz 2019-12-23 17:30:53 UTC

A use-after-free flaw was found in the Linux kernels implementation of blktrace in the __blk_add_trace function. A local attacker with permissions to run block trace instructions against a device can create a situation where the core block_trace object is used after it is freed.  The attacker can pre-groom memory to race this use-after-free to create a condition where memory is corrupted and also likely to be privilege escalation.

The ability to create this condition requires elevated privileges, and it has been decided that this change in Red Hat Enterprise Linux 5 and 6 would risk introducing possible regressions and will not be backported.


Reference:
https://bugzilla.kernel.org/show_bug.cgi?id=205711

Patch:
A patch may be attached to the bugzilla.kernel.org but no patch exists at this time.

Comment 1 Guilherme de Almeida Suckevicz 2019-12-23 17:33:17 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1786166]

Comment 3 Wade Mealing 2020-02-04 08:06:42 UTC

While this flaw is rated as important, it was a difficult decision to make.  Users who are granted permissions on system block devices can likely find other ways of doing this, such as modifying the setuid bits on mounted filesystems, or perverting the contents of setuid files, or just the password file itself if they can access it on that block device.

Comment 14 Justin M. Forbes 2020-03-20 15:17:08 UTC

This was fixed for Fedora with the 5.5.8 stable kernel updates.

Comment 15 errata-xmlrpc 2020-04-28 15:25:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1567 https://access.redhat.com/errata/RHSA-2020:1567

Comment 16 errata-xmlrpc 2020-04-28 15:51:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1769 https://access.redhat.com/errata/RHSA-2020:1769

Comment 17 Product Security DevOps Team 2020-04-28 16:35:05 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19768

Comment 18 errata-xmlrpc 2020-04-29 09:36:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:1966 https://access.redhat.com/errata/RHSA-2020:1966

Comment 19 errata-xmlrpc 2020-05-12 15:12:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2104 https://access.redhat.com/errata/RHSA-2020:2104

Comment 20 errata-xmlrpc 2020-05-12 18:38:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2082 https://access.redhat.com/errata/RHSA-2020:2082

Comment 21 errata-xmlrpc 2020-05-12 18:38:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2085 https://access.redhat.com/errata/RHSA-2020:2085

Comment 22 errata-xmlrpc 2020-05-19 12:37:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:2199 https://access.redhat.com/errata/RHSA-2020:2199

Comment 23 errata-xmlrpc 2020-05-19 12:38:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:2203 https://access.redhat.com/errata/RHSA-2020:2203

Comment 24 errata-xmlrpc 2020-05-19 14:41:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2020:2214 https://access.redhat.com/errata/RHSA-2020:2214

Comment 25 errata-xmlrpc 2020-05-20 17:35:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2020:2242 https://access.redhat.com/errata/RHSA-2020:2242

Comment 27 errata-xmlrpc 2020-05-26 08:48:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Advanced Update Support

Via RHSA-2020:2285 https://access.redhat.com/errata/RHSA-2020:2285

Comment 28 errata-xmlrpc 2020-05-26 09:39:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.3 Telco Extended Update Support

Via RHSA-2020:2277 https://access.redhat.com/errata/RHSA-2020:2277

Comment 29 errata-xmlrpc 2020-05-26 11:17:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2020:2289 https://access.redhat.com/errata/RHSA-2020:2289

Comment 30 errata-xmlrpc 2020-05-26 11:17:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2020:2291 https://access.redhat.com/errata/RHSA-2020:2291

Comment 32 errata-xmlrpc 2020-06-11 01:33:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2020:2519 https://access.redhat.com/errata/RHSA-2020:2519

Comment 33 errata-xmlrpc 2020-06-11 02:10:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2020:2522 https://access.redhat.com/errata/RHSA-2020:2522