CVE-2018-19985: Medium severity IBM Data Risk Manager vulnerability
A flaw was found in the Linux kernel in the function hsoprobe() which reads ifnum value from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hsoprobe() or hsogetconfigdata(). An attacker with a forged USB device and physical access to a system (needed to connect such a device) can cause a system crash and a denial of service.
Other sources
A flaw was found in the Linux kernel in the function hsoprobe() which reads ifnum value from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hsoprobe() or hsogetconfigdata(). An attacker with forged USB device with a physical access to a system (needed to connect such a device) can cause a system crash and a denial-of-service.
References:
https://marc.info/?t=154461511700001&r=1&w=2
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5146f95df782b0ac61abde36567e718692725c89
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds read in the hsogetconfigdata function in drivers/net/usb/hso.c. A local attacker could exploit this vulnerability to cause the system to crash.
— IBM
The function hsogetconfigdata in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads ifnum from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1127.rt56.1093.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1127.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.rt24.93.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.20 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.1.177-1Fixed in 6.12.94-1Fixed in 6.12.96-1Fixed in 7.1.3-1Fixed in 7.1.4-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Patch 5146f95df782b0ac61abde36567e718692725c89
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-19985?
CVE-2018-19985 has a moderate severity rating due to its potential for out-of-bounds memory read exploits.
How do I fix CVE-2018-19985?
The recommended fix for CVE-2018-19985 is to update the kernel to versions 0:3.10.0-1127.rt56.1093.el7, 0:3.10.0-1127.el7, or newer.
Which systems are affected by CVE-2018-19985?
CVE-2018-19985 affects various systems running specific versions of the Linux kernel, including Red Hat and Debian distributions.
Can CVE-2018-19985 be exploited remotely?
CVE-2018-19985 requires physical access to exploit, as it involves a forged USB device.
Is there a patch available for CVE-2018-19985?
Yes, patches are available for CVE-2018-19985 and should be applied as part of the kernel updates.