Bug 2189137 (CVE-2023-2019, ZDI-23-442, ZDI-CAN-17811)

Summary: CVE-2023-2019 kernel: netdevsim: fib: reference count leak on route deletion failure
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, ldoskova, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 6.0-rc1 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel's netdevsim device driver within the scheduling of events. This issue results from improper management of a reference count. This flaw allows an attacker to create a denial of service condition on the system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2189203, 2189204    
Bug Blocks: 2186277    

Description Mauro Matteo Cascella 2023-04-24 10:55:33 UTC 
A reference count issue was found in the Linux kernel's netdevsim device driver. Quoting ZDI security advisory [1]:

"This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the scheduling of events. The issue results from the improper management of a reference count. An attacker can leverage this vulnerability to create a denial-of-service condition on the system."

[1] https://www.zerodayinitiative.com/advisories/ZDI-CAN-17811/
Comment 3 Mauro Matteo Cascella 2023-04-24 12:49:27 UTC 
Upstream fix:
https://github.com/torvalds/linux/commit/180a6a3ee60a