Bug 2266290 (CVE-2019-25160)

Summary:	CVE-2019-25160 kernel: out-of-bounds memory accesses in netlabel
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, esandeen, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, sukulkar, tglozar, tyberry, vkumar, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in the Linux kernel. An out-of-bounds (OOB) memory access flaw exists in the netlabel driver module. This may lead to a crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2266293
Bug Blocks:	2266294

Description Rohit Keshri 2024-02-27 13:22:42 UTC

In the Linux kernel, the following vulnerability has been resolved:

netlabel: fix out-of-bounds memory accesses

There are two array out-of-bounds memory accesses, one in
cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk().  Both
errors are embarassingly simple, and the fixes are straightforward.

As a FYI for anyone backporting this patch to kernels prior to v4.8,
you'll want to apply the netlbl_bitmap_walk() patch to
cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before
Linux v4.8.

https://git.kernel.org/stable/c/1c973f9c7cc2b3caae93192fdc8ecb3f0b4ac000
https://git.kernel.org/stable/c/5578de4834fe0f2a34fedc7374be691443396d1f
https://git.kernel.org/stable/c/97bc3683c24999ee621d847c9348c75d2fe86272
https://git.kernel.org/stable/c/c61d01faa5550e06794dcf86125ccd325bfad950
https://git.kernel.org/stable/c/dc18101f95fa6e815f426316b8b9a5cee28a334e
https://git.kernel.org/stable/c/e3713abc4248aa6bcc11173d754c418b02a62cbb
https://git.kernel.org/stable/c/fbf9578919d6c91100ec63acf2cba641383f6c78
https://git.kernel.org/stable/c/fcfe700acdc1c72eab231300e82b962bac2b2b2c

Comment 1 Rohit Keshri 2024-02-27 13:37:24 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2266293]

Comment 3 Justin M. Forbes 2024-02-27 19:05:04 UTC

This was fixed for Fedora with the 4.20.15 stable kernel updates.

Comment 5 Alex 2024-06-09 13:37:19 UTC

The result of automatic check (that is developed by Alexander Larkin) for this CVE-2019-25160 is: 	SKIP	The required patch already applied both for rhel8 and for rhel9: 5578de4834fe0f2a34fedc7374be691443396d1f	YES			YES	YES	unknown (where first YES/NO value means if related sources built).