Bugzilla – Bug 1131430
VUL-1: CVE-2019-3837: kernel-source: memory leak in tcp_recvmsg() with NET_DMA
Last modified: 2023-02-15 14:22:24 UTC
CVE-2019-3837 via oss-sec From: Vladis Dronov <vdronov@redhat.com> Date: Wed, 3 Apr 2019 08:29:50 -0400 (EDT) Subject: [oss-security] CVE-2019-3837: RHEL6: memory leak in tcp_recvmsg() with NET_DMA Heololo, It was found that the net_dma code in tcp_recvmsg() in the RHEL6 kernel is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service, or cause a random memory corruption. This flaw was assigned an id of CVE-2019-3837. net_dma was disabled in the upstream Linux kernel since v3.13-rc5 by the 77873803363c "net_dma: mark broken" and then completely removed by the 7bced397510a "net_dma: simple removal". So this flaw affects RHEL-6 only and any (LTS) Linux kernel (of any distribution) which has not backported the net_dma disabling commits mentioned above. Best regards, Vladis Dronov | Red Hat, Inc. | Product Security | Senior Software Engineer References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-3837
3.12 based branches got commit 77873803363c (marking CONFIG_NET_DMA as broken) via 3.12.7 stable updated so that we don't have CONFIG_NET_DMA enabled on any kernel branch based on 3.12 or newer. Branches based on 3.0 and older have CONFIG_NET_DMA enabled and will need a fix. With the information available (which is not very specific), the easiest way to handle the problem (without breaking kABI) would be modifying the receive path code to behave as if NET_DMA was disabled (or at least behave as if sysctl_tcp_dma_copybreak was infinity). A bit more work but cleaner and safer approacho would be to drop all code fragments inside "#ifdef NET_DMA" (except member declarations in kABI protected structures). More proper approach woud probably require making the access to IOAT DMA exclusive somehow but as one of the reasons for dropping the feature was that it didn't really help much, I don't think it's worth the effort and, more important, the risk.
Submitted a patch that drops most of "#ifdef CONFIG_NET_DMA" sections from networking code but preserves kABI into cve/linux-3.0. No newer branch is affected as all have the code gone already (since mainline 3.18-rc1). Reassigning back to security team.
SUSE-SU-2023:0416-1: An update that solves 62 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1055710,1084513,1131430,1133374,1154848,1166098,1173514,1177471,1191961,1196973,1197331,1197343,1197366,1197391,1198516,1198829,1199063,1199426,1199487,1199650,1199657,1200598,1200619,1200692,1200910,1201050,1201251,1201429,1201635,1201636,1201940,1201948,1202097,1202346,1202347,1202393,1202500,1202897,1202898,1202960,1203107,1203271,1203514,1203769,1203960,1203987,1204166,1204354,1204405,1204431,1204439,1204574,1204631,1204646,1204647,1204653,1204894,1204922,1205220,1205514,1205671,1205796,1206677 CVE References: CVE-2017-13695,CVE-2018-7755,CVE-2019-3837,CVE-2019-3900,CVE-2020-15393,CVE-2020-16119,CVE-2020-36557,CVE-2020-36558,CVE-2021-26341,CVE-2021-33655,CVE-2021-33656,CVE-2021-34981,CVE-2021-39713,CVE-2021-45868,CVE-2022-1011,CVE-2022-1048,CVE-2022-1353,CVE-2022-1462,CVE-2022-1652,CVE-2022-1679,CVE-2022-20132,CVE-2022-20166,CVE-2022-20368,CVE-2022-20369,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-21385,CVE-2022-21499,CVE-2022-2318,CVE-2022-2663,CVE-2022-28356,CVE-2022-29900,CVE-2022-29901,CVE-2022-3028,CVE-2022-3303,CVE-2022-33981,CVE-2022-3424,CVE-2022-3524,CVE-2022-3565,CVE-2022-3566,CVE-2022-3586,CVE-2022-3621,CVE-2022-3635,CVE-2022-3646,CVE-2022-3649,CVE-2022-36879,CVE-2022-36946,CVE-2022-3903,CVE-2022-39188,CVE-2022-40768,CVE-2022-4095,CVE-2022-41218,CVE-2022-41848,CVE-2022-41850,CVE-2022-41858,CVE-2022-43750,CVE-2022-44032,CVE-2022-44033,CVE-2022-45934 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS-EXTREME-CORE (src): kernel-default-3.0.101-108.138.1, kernel-ec2-3.0.101-108.138.1, kernel-source-3.0.101-108.138.1, kernel-syms-3.0.101-108.138.1, kernel-trace-3.0.101-108.138.1, kernel-xen-3.0.101-108.138.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.