This is fixed for Fedora with the 5.3.7 stable kernel update.
A flaw was found in the Linux kernels implementation for ADU devices from Ontrak Control Systems, where an attacker a local account to pre-groom the memory and the ability to physically (ability to unplug) disconnect or unload a module (administrative privileges). The attacker must be able to trigger either of these two events to trigger the use-after-free, and then race the access to the use-after-free to create a situation where key usb structs can be manipulated into corrupting memory.
Because of the physical/administrative priv requirement, This likely doesn't qualify for an important fix, dropping it to moderate. I think it probably should get fixed but its not urgently related. I'd be perfectly fine with having this module disabled or auto-blacklisted so it can't be loaded on any system without admin intervention. I really do not know how many customers we'd have using this module. Feel free to drop a comment in this bz if you are. Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=44efc269db7929f6275a1fa927ef082e533ecde0 References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.7 http://seclists.org/oss-sec/2019/q4/115 https://www.openwall.com/lists/oss-security/2019/12/03/4
Mitigation: As the system module will be auto-loaded when a device that uses the driver is attached (via USB), its use can be disabled by preventing the module from loading with the following instructions: # echo "install adutux /bin/true" >> /etc/modprobe.d/disable-adutux.conf The system will need to be restarted if the adutux module are loaded. In most circumstances, the kernel modules will be unable to be unloaded while any hardware is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1798820]
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4062 https://access.redhat.com/errata/RHSA-2020:4062
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4060 https://access.redhat.com/errata/RHSA-2020:4060
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-19523
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1739 https://access.redhat.com/errata/RHSA-2021:1739