Bug 1783540 (CVE-2019-19534) - CVE-2019-19534 kernel: information leak bug caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver
Summary: CVE-2019-19534 kernel: information leak bug caused by a malicious USB device ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-19534
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Engineering1787484 Engineering1787485 Engineering1787486 Engineering1787487 1796101 Engineering1796102
Blocks: Embargoed1783543
TreeView+ depends on / blocked
 
Reported: 2019-12-13 21:34 UTC by msiddiqu
Modified: 2021-02-16 20:51 UTC (History)
44 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An information-leak flaw was found in the Linux kernel's pcan USB driver. When a device using this driver connects to the system, the stack information is leaked to the CAN bus, a controller area network for automobiles. The highest threat with this vulnerability is breach of data confidentiality.
Clone Of:
Environment:
Last Closed: 2020-04-28 16:35:01 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:2052 0 None None None 2020-05-11 12:53:58 UTC
Red Hat Product Errata RHBA-2020:2626 0 None None None 2020-06-19 01:50:11 UTC
Red Hat Product Errata RHBA-2020:4416 0 None None None 2020-10-29 15:09:54 UTC
Red Hat Product Errata RHBA-2020:4417 0 None None None 2020-10-29 15:08:25 UTC
Red Hat Product Errata RHBA-2020:4418 0 None None None 2020-10-29 15:13:49 UTC
Red Hat Product Errata RHBA-2020:4419 0 None None None 2020-10-29 15:12:15 UTC
Red Hat Product Errata RHBA-2020:4420 0 None None None 2020-10-29 15:51:52 UTC
Red Hat Product Errata RHSA-2020:1567 0 None None None 2020-04-28 15:25:20 UTC
Red Hat Product Errata RHSA-2020:1769 0 None None None 2020-04-28 15:51:56 UTC
Red Hat Product Errata RHSA-2020:4060 0 None None None 2020-09-29 20:52:49 UTC
Red Hat Product Errata RHSA-2020:4062 0 None None None 2020-09-29 18:58:52 UTC

Description msiddiqu 2019-12-13 21:34:00 UTC 
In the Linux kernel, there is an information leak caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c

Upstream Patch:
  
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f7a1337f0d29b98733c8824e165fca3371d7d4fd

References: 

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11
http://seclists.org/oss-sec/2019/q4/115
https://www.openwall.com/lists/oss-security/2019/12/03/4
Comment 1 Justin M. Forbes 2019-12-16 17:16:46 UTC 
This was fixed for Fedora with the 5.3.11 stable kernel update.
Comment 5 Wade Mealing 2020-01-03 04:50:15 UTC 
At this time, it appears that the stack information leak would appear on the CANBUS.  For interested parties this is not a 'traditional' network like ethernet but specifically used in car/boat/industrial style applications.

This would leak a system that -has- one of these usb devices attached to devices 'on' the canbus.
Comment 8 Eric Christensen 2020-01-09 02:41:23 UTC 
Mitigation:

As the devices module will be auto-loaded when the USB CAN bus adapter is connected, its can be disabled by preventing the module from loading with the following instructions:

# echo "install peak_usb /bin/true" >> /etc/modprobe.d/disable-peak-usb-canbus.conf 
 
The system will need to be restarted if the peak_usb module is already loaded. In most circumstances, the kernel modules will be unable to be unloaded while any CAN bus interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.
Comment 9 Petr Matousek 2020-01-29 15:51:05 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1796101]
Comment 11 errata-xmlrpc 2020-04-28 15:25:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1567 https://access.redhat.com/errata/RHSA-2020:1567
Comment 12 errata-xmlrpc 2020-04-28 15:51:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1769 https://access.redhat.com/errata/RHSA-2020:1769
Comment 13 Product Security DevOps Team 2020-04-28 16:35:01 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19534
Comment 14 errata-xmlrpc 2020-09-29 18:58:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4062 https://access.redhat.com/errata/RHSA-2020:4062
Comment 15 errata-xmlrpc 2020-09-29 20:52:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4060 https://access.redhat.com/errata/RHSA-2020:4060
Note You need to log in before you can comment on or make changes to this bug.