Bug 1833352 (CVE-2019-14587)

Summary: CVE-2019-14587 edk2: double-unmap issue in SdMmcCreateTrb function in MdeModulePkg/Bus/Pci/SdMmcPciHcDxe/SdMmcPciHci.c
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: berrange, crobinso, kraxel, lersek, pbonzini, philmd, virt-maint, virt-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-05-29 17:20:38 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1833353, 1833354    
Bug Blocks: 1833355    

Description Guilherme de Almeida Suckevicz 2020-05-08 13:55:33 UTC
In edk2, a double-unmap issue was found in SdMmcCreateTrb() as a result of calling PciIo->Unmap. Within an error condition, as well as within the body of the SdMmcFreeTrb() which is also called on error. It's unclear if this will have exploitable properties in cases where other devices share a DMA mapping.


Upstream commit:

Comment 1 Guilherme de Almeida Suckevicz 2020-05-08 13:55:57 UTC
Created edk2 tracking bugs for this issue:

Affects: epel-all [bug 1833354]
Affects: fedora-all [bug 1833353]

Comment 4 Riccardo Schirone 2020-05-29 14:31:21 UTC
Marking rhel-7/ovmf and rhel-8/edk2 as notaffected as they don't include SdMmcPciHcDxe, as already mentioned in https://bugzilla.tianocore.org/show_bug.cgi?id=1989#c6 .

Comment 5 Product Security DevOps Team 2020-05-29 17:20:38 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):