Bug 1783434 (CVE-2019-19523) - CVE-2019-19523 kernel: use-after-free caused by a malicious USB device in the drivers/usb/misc/adutux.c driver
Summary: CVE-2019-19523 kernel: use-after-free caused by a malicious USB device in the...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-19523
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1798820 1798821 1798822 1798823 1798824 1798825 1798826 1888704 1900751
Blocks: 1783438
TreeView+ depends on / blocked
 
Reported: 2019-12-13 18:35 UTC by msiddiqu
Modified: 2021-06-24 11:50 UTC (History)
45 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s implementation for ADU devices from Ontrak Control Systems, where an attacker with administrative privileges and access to a local account could pre-groom the memory and physically disconnect or unload a module. The attacker must be able to access either of these two events to trigger the use-after-free, and then race the access to the use-after-free, to create a situation where key USB structs can be manipulated into corrupting memory.
Clone Of:
Environment:
Last Closed: 2020-09-29 21:59:10 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:4416 0 None None None 2020-10-29 15:09:48 UTC
Red Hat Product Errata RHBA-2020:4417 0 None None None 2020-10-29 15:08:16 UTC
Red Hat Product Errata RHBA-2020:4418 0 None None None 2020-10-29 15:13:43 UTC
Red Hat Product Errata RHBA-2020:4419 0 None None None 2020-10-29 15:11:48 UTC
Red Hat Product Errata RHBA-2020:4420 0 None None None 2020-10-29 15:51:46 UTC
Red Hat Product Errata RHBA-2021:2538 0 None None None 2021-06-23 18:05:46 UTC
Red Hat Product Errata RHBA-2021:2541 0 None None None 2021-06-24 11:50:25 UTC
Red Hat Product Errata RHSA-2020:4060 0 None None None 2020-09-29 20:52:32 UTC
Red Hat Product Errata RHSA-2020:4062 0 None None None 2020-09-29 18:58:41 UTC

Comment 1 Justin M. Forbes 2019-12-16 16:44:58 UTC 
This is fixed for Fedora with the 5.3.7 stable kernel update.
Comment 3 Wade Mealing 2020-02-06 04:49:30 UTC 
A flaw was found in the Linux kernels implementation for ADU devices from Ontrak Control Systems, where  an attacker a local account to pre-groom the memory and the ability to physically (ability to unplug) disconnect or unload a module (administrative privileges).  The attacker must be able to trigger either of these two events to trigger the use-after-free, and then race the access to the use-after-free to create a situation where key usb structs can be manipulated into corrupting memory.
Comment 4 Wade Mealing 2020-02-06 05:00:14 UTC 
Because of the physical/administrative priv requirement, This likely doesn't qualify for an important fix, dropping it to moderate. I think it probably should get fixed but its not urgently related.  

I'd be perfectly fine with having this module disabled or auto-blacklisted so it can't be loaded on any system without admin intervention. I really do not know how many customers we'd have using this module.  Feel free to drop a comment in this bz if you are.


Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=44efc269db7929f6275a1fa927ef082e533ecde0

References: 

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.7
http://seclists.org/oss-sec/2019/q4/115
https://www.openwall.com/lists/oss-security/2019/12/03/4
Comment 6 Wade Mealing 2020-02-06 05:09:02 UTC 
Mitigation:


As the system module will be auto-loaded when a device that uses the driver is attached (via USB), its use can be disabled  by preventing the module from loading with the following instructions:

# echo "install adutux /bin/true" >> /etc/modprobe.d/disable-adutux.conf
 
The system will need to be restarted if the adutux module are loaded. In most circumstances, the kernel modules will be unable to be unloaded while any hardware is in use.

If the system requires this module to work correctly, this mitigation may not be suitable.

If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.
Comment 7 Wade Mealing 2020-02-06 05:15:41 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1798820]
Comment 12 errata-xmlrpc 2020-09-29 18:58:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4062 https://access.redhat.com/errata/RHSA-2020:4062
Comment 13 errata-xmlrpc 2020-09-29 20:52:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4060 https://access.redhat.com/errata/RHSA-2020:4060
Comment 14 Product Security DevOps Team 2020-09-29 21:59:10 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19523
Comment 31 errata-xmlrpc 2021-05-18 13:19:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578
Comment 32 errata-xmlrpc 2021-05-18 14:40:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1739 https://access.redhat.com/errata/RHSA-2021:1739
Note You need to log in before you can comment on or make changes to this bug.