Bug 1743526 (CVE-2019-15090) - CVE-2019-15090 kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure
Summary: CVE-2019-15090 kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c ...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2019-15090
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1743527
TreeView+ depends on / blocked
 
Reported: 2019-08-20 07:49 UTC by Marian Rehak
Modified: 2020-02-13 16:20 UTC (History)
47 users (show)

Fixed In Version: kernel 5.1.12
Doc Type: If docs needed, set a value
Doc Text:
A memory overrun vulnerability was found in the Linux kernel's qedi_dbg_* family of functions prior to version 5.1.12. If the source string is less than the destination buffer length, an out-of-bounds read could occur by using nfunc instead of func directly.
Clone Of:
Environment:
Last Closed: 2020-02-13 14:09:36 UTC


Attachments (Terms of Use)

Description Marian Rehak 2019-08-20 07:49:30 UTC
An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of functions, there is an out-of-bounds read.

Upstream Fix:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c09581a52765a85f19fc35340127396d5e3379cc

Comment 2 Rohit Keshri 2020-02-13 08:44:24 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 3 Product Security DevOps Team 2020-02-13 14:09:36 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-15090


Note You need to log in before you can comment on or make changes to this bug.