On 9/2/19 1:06 PM, Greg KH wrote:
On Mon, Sep 02, 2019 at 12:32:37PM -0700, Guenter Roeck wrote:
On 9/2/19 11:47 AM, Greg KH wrote:
On Sun, Sep 01, 2019 at 07:08:29AM -0700, Guenter Roeck wrote:
On 9/1/19 1:03 AM, Kalle Valo wrote:
Guenter Roeck <linux@xxxxxxxxxxxx> writes:
On Mon, Aug 19, 2019 at 06:02:29PM -0400, Hui Peng wrote:
`dev` (struct rsi_91x_usbdev *) field of adapter
(struct rsi_91x_usbdev *) is allocated and initialized in
`rsi_init_usb_interface`. If any error is detected in information
read from the device side, `rsi_init_usb_interface` will be
freed. However, in the higher level error handling code in
`rsi_probe`, if error is detected, `rsi_91x_deinit` is called
again, in which `dev` will be freed again, resulting double free.
This patch fixes the double free by removing the free operation on
`dev` in `rsi_init_usb_interface`, because `rsi_91x_deinit` is also
used in `rsi_disconnect`, in that code path, the `dev` field is not
(and thus needs to be) freed.
This bug was found in v4.19, but is also present in the latest version
of kernel.
Reported-by: Hui Peng <benquike@xxxxxxxxx>
Reported-by: Mathias Payer <mathias.payer@xxxxxxxxxxxxx>
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
FWIW:
Reviewed-by: Guenter Roeck <linux@xxxxxxxxxxxx>
This patch is listed as fix for CVE-2019-15504, which has a CVSS 2.0 score
of 10.0 (high) and CVSS 3.0 score of 9.8 (critical).
A double free in error path is considered as a critical CVE issue? I'm
very curious, why is that?
You'd have to ask the people assigning CVSS scores. However, if the memory
was reallocated, that reallocated memory (which is still in use) is freed.
Then all kinds of bad things can happen.
Yes, but moving from "bad things _can_ happen" to "bad things happen" in
an instance like this will be a tough task. It also requires physical
access to the machine.
Is this correct even with usbip enabled ?
Who has usbip enabled anywhere? :)
It is enabled in Ubuntu, and it looks like it is enabled in Fedora as well.
It is disabled in Chrome OS. I didn't check other distributions.
I don't know if usbip can trigger this type of thing, maybe someone
needs to test that...
I seemed to recall someone mentioning that it is possible to use usbip
for remote attacks. This is why I mentioned it. I don't recall details,
though, and I don't know if it is really possible and to what extent.
Guenter
