Bug 1831055 (CVE-2019-15794)

Summary:	CVE-2019-15794 kernel: Overlayfs in the Linux kernel and shiftfs not restoring original value on error leading to a refcount underflow
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, allarkin, aquini, bhu, blc, bmasney, brdeoliv, bskeggs, cye, dbohanno, dfreiber, dhoward, dvlasenk, esammons, esandeen, eshatokhin, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarod, jarodwilson, jburrell, jeremy, jfaracco, jforbes, jlelli, joe.lawrence, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lcapitulino, lgoncalv, linville, lzampier, masami256, mchehab, mcressma, mjg59, mlangsdo, mleitner, mmilgram, mszeredi, nmurray, ptalbert, qzhao, rkeshri, rogbas, rparrazo, rrobaina, rt-maint, rvrbovsk, rysulliv, scweaver, steved, sukulkar, vkumar, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel. In Overlayfs, vma->vm_file was replaced in the mmap handlers and, on errors, the original value is not restored. A local attacker with special user privilege (or root) can cause a kernel internal information leak. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-12-15 11:30:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1832271, 1832276, 1832277
Bug Blocks:	1831035

Description Michael Kaplan 2020-05-04 14:30:54 UTC

An issue was found in Overlayfs in the Linux kernel were it replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. 

On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patchs change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow. This can lead to an invalid address access and a DoS problem.


Reference:

https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1850994

Comment 2 Michael Kaplan 2020-05-06 12:41:14 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1832271]

Comment 4 Rohit Keshri 2020-05-06 13:02:52 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 14 Wade Mealing 2020-05-12 00:57:58 UTC

The use case of compiling a third party AUFS (filesystem) to allow this flaw to be triggered, means that this flaw is not able to be triggered for most users of overlayfs in Red Hat Enterprise Linux.