Bug 1783540 (CVE-2019-19534) - CVE-2019-19534 kernel: information leak bug caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver
Summary: CVE-2019-19534 kernel: information leak bug caused by a malicious USB device...
Keywords:
Status: NEW
Alias: CVE-2019-19534
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1787484 1787486 1787487 1796102 1787485 1796101
Blocks: 1783543
TreeView+ depends on / blocked
 
Reported: 2019-12-13 21:34 UTC by msiddiqu
Modified: 2020-01-29 15:51 UTC (History)
44 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An information-leak flaw was found in the Linux kernel's pcan USB driver. When a device using this driver connects to the system, the stack information is leaked to the CAN bus, a controller area network for automobiles. The highest threat with this vulnerability is breach of data confidentiality.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description msiddiqu 2019-12-13 21:34:00 UTC
In the Linux kernel, there is an information leak caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c

Upstream Patch:
  
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f7a1337f0d29b98733c8824e165fca3371d7d4fd

References: 

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11
http://seclists.org/oss-sec/2019/q4/115
https://www.openwall.com/lists/oss-security/2019/12/03/4

Comment 1 Justin M. Forbes 2019-12-16 17:16:46 UTC
This was fixed for Fedora with the 5.3.11 stable kernel update.

Comment 5 Wade Mealing 2020-01-03 04:50:15 UTC
At this time, it appears that the stack information leak would appear on the CANBUS.  For interested parties this is not a 'traditional' network like ethernet but specifically used in car/boat/industrial style applications.

This would leak a system that -has- one of these usb devices attached to devices 'on' the canbus.

Comment 8 Eric Christensen 2020-01-09 02:41:23 UTC
Mitigation:

As the devices module will be auto-loaded when the USB CAN bus adapter is connected, its can be disabled by preventing the module from loading with the following instructions:

# echo "install peak_usb /bin/true" >> /etc/modprobe.d/disable-peak-usb-canbus.conf 
 
The system will need to be restarted if the peak_usb module is already loaded. In most circumstances, the kernel modules will be unable to be unloaded while any CAN bus interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

Comment 9 Petr Matousek 2020-01-29 15:51:05 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1796101]


Note You need to log in before you can comment on or make changes to this bug.