CVE-2018-19985: Medium severity IBM Data Risk Manager vulnerability
A flaw was found in the Linux kernel in the function hsoprobe() which reads ifnum value from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hsoprobe() or hsogetconfigdata(). An attacker with a forged USB device and physical access to a system (needed to connect such a device) can cause a system crash and a denial of service.
Other sources
A flaw was found in the Linux kernel in the function hsoprobe() which reads ifnum value from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hsoprobe() or hsogetconfigdata(). An attacker with forged USB device with a physical access to a system (needed to connect such a device) can cause a system crash and a denial-of-service.
References:
https://marc.info/?t=154461511700001&r=1&w=2
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5146f95df782b0ac61abde36567e718692725c89
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds read in the hsogetconfigdata function in drivers/net/usb/hso.c. A local attacker could exploit this vulnerability to cause the system to crash.
— IBM
The function hsogetconfigdata in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads ifnum from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-19985?
CVE-2018-19985 has a moderate severity rating due to its potential for out-of-bounds memory read exploits.
How do I fix CVE-2018-19985?
The recommended fix for CVE-2018-19985 is to update the kernel to versions 0:3.10.0-1127.rt56.1093.el7, 0:3.10.0-1127.el7, or newer.
Which systems are affected by CVE-2018-19985?
CVE-2018-19985 affects various systems running specific versions of the Linux kernel, including Red Hat and Debian distributions.
Can CVE-2018-19985 be exploited remotely?
CVE-2018-19985 requires physical access to exploit, as it involves a forged USB device.
Is there a patch available for CVE-2018-19985?
Yes, patches are available for CVE-2018-19985 and should be applied as part of the kernel updates.