Bug 1666106 (CVE-2018-19985) - CVE-2018-19985 kernel: oob memory read in hso_probe in drivers/net/usb/hso.c
Summary: CVE-2018-19985 kernel: oob memory read in hso_probe in drivers/net/usb/hso.c
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-19985
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1666107 1666659 1666660 1666661 1666662 1666663
Blocks: 1666108
TreeView+ depends on / blocked
 
Reported: 2019-01-14 22:44 UTC by Laura Pardo
Modified: 2021-02-16 22:33 UTC (History)
2 users (show)

Fixed In Version: kernel 4.20
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel in the function hso_probe() which reads if_num value from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hso_probe() or hso_get_config_data(). An attacker with a forged USB device and physical access to a system (needed to connect such a device) can cause a system crash and a denial of service.
Clone Of:
Environment:
Last Closed: 2019-11-06 00:51:42 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3309 0 None None None 2019-11-05 20:35:11 UTC
Red Hat Product Errata RHSA-2019:3517 0 None None None 2019-11-05 21:05:53 UTC
Red Hat Product Errata RHSA-2020:1016 0 None None None 2020-03-31 19:11:25 UTC
Red Hat Product Errata RHSA-2020:1070 0 None None None 2020-03-31 19:20:27 UTC

Description Laura Pardo 2019-01-14 22:44:37 UTC 
A flaw was found in the Linux kernel in the function hso_probe() which reads if_num value from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hso_probe() or hso_get_config_data(). An attacker with forged USB device with a physical access to a system (needed to connect such a device) can cause a system crash and a denial-of-service.

References:

https://marc.info/?t=154461511700001&r=1&w=2

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5146f95df782b0ac61abde36567e718692725c89
Comment 1 Laura Pardo 2019-01-14 22:44:50 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1666107]
Comment 2 Justin M. Forbes 2019-01-15 13:54:46 UTC 
This was fixed for Fedora with the 4.19.13 stable kernel update.
Comment 6 errata-xmlrpc 2019-11-05 20:35:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3309 https://access.redhat.com/errata/RHSA-2019:3309
Comment 7 errata-xmlrpc 2019-11-05 21:05:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3517 https://access.redhat.com/errata/RHSA-2019:3517
Comment 8 Product Security DevOps Team 2019-11-06 00:51:42 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-19985
Comment 9 errata-xmlrpc 2020-03-31 19:11:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1016 https://access.redhat.com/errata/RHSA-2020:1016
Comment 10 errata-xmlrpc 2020-03-31 19:20:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1070 https://access.redhat.com/errata/RHSA-2020:1070
Note You need to log in before you can comment on or make changes to this bug.