Bug 1772527 (CVE-2019-18680) - CVE-2019-18680 kernel: NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c
Summary: CVE-2019-18680 kernel: NULL pointer dereference in rds_tcp_kill_sock() in net...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2019-18680
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1772528
Blocks: Embargoed1772529
TreeView+ depends on / blocked
 
Reported: 2019-11-14 14:53 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-02-16 21:03 UTC (History)
48 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel's implementation of RDS over TCP. A system that has the rds_tcp kernel module that is loaded through an autoload via a local process running listen(), or manual loading, could possibly cause a kernel panic.
Clone Of:
Environment:
Last Closed: 2020-02-17 14:09:56 UTC

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2019-11-14 14:53:06 UTC 
A flaw was found in the linux kernels implementation of RDS over TCP.  A system that has the rds_tcp kernel module loaded (either through autoload via local process running listen(), or manual loading) could possibly cause a kernel panic.


Reference and upstream commit:

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=91573ae4aed0a49660abdad4d42f2a0db995ee5e
Comment 1 Guilherme de Almeida Suckevicz 2019-11-14 14:53:27 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1772528]
Comment 2 Justin M. Forbes 2019-11-14 17:05:29 UTC 
This does not impact any currently supported Fedora kernel.
Comment 4 Wade Mealing 2020-02-17 12:42:54 UTC 
Mitigation:

While this is a network protocol being affected, the protocol is not available by default.  A local process (or user) can trigger the protocol to be used which will then be loaded automatically would then have the vulnerable code loaded and the attack vector opened.  To reiterate it is unlikely that most Linux systems will be using this protocol and therefore affected.

Most systems do _NOT_ have this protocol used by services.   This is an infrequently used module and if you wish to blacklist it, you can follow the steps outlined in https://access.redhat.com/solutions/41278 to blacklist the "rds_tcp" module for the relevant version of Red Hat Enterprise Linux.
Comment 6 Wade Mealing 2020-02-17 12:59:46 UTC 
Rating this as a low, as it's not in use by default, there are not many services even use RDS over TCP and it crashes the system, no privilege escalation the initial investigation.  

If this affects your system in another way, please feel free to lodge a support case, it is not compiled/enabled for rhel 7 and 8 based kernels.
Comment 7 Product Security DevOps Team 2020-02-17 14:09:56 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-18680
Note You need to log in before you can comment on or make changes to this bug.