Bug 1139868 – VUL-1: CVE-2019-12983: kernel-source: function do_hidp_sock_ioctl does not ensure that certain device field ends with a '\0'

Bug 1139868 - (CVE-2019-12983) VUL-1: CVE-2019-12983: kernel-source: function do_hidp_sock_ioctl does not ensure that certain device field ends with a '\0'

(CVE-2019-12983)
Summary:	VUL-1: CVE-2019-12983: kernel-source: function do_hidp_sock_ioctl does not en...

Status:	RESOLVED DUPLICATE of bug 1134848

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Minor
Target Milestone:	---
Assigned To:	Oliver Neukum
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/235759/
Whiteboard:
Keywords:

Depends on:	CVE-2019-11884
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2019-07-01 08:48 UTC by Alexander Bergmann
Modified:	2020-06-25 08:03 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexander Bergmann 2019-07-01 08:48:21 UTC

CVE-2019-12983

In the Linux kernel before 5.0.15, the function do_hidp_sock_ioctl in
net/bluetooth/hidp/sock.c does not ensure that a certain device field ends with
a '\0' character, which allows local users to obtain potentially sensitive
information from kernel stack memory, or cause a denial of service, which is
similar to CVE-2011-1079. The user would use an HIDPCONNADD command.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12983
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12983
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.15
https://github.com/torvalds/linux/commit/a1616a5ac99ede5d605047a9012481ce7ff18b16

Comment 2 Oliver Neukum 2019-07-01 12:36:09 UTC

Takashi pushed this patch in in May.

Comment 3 Marcus Meissner 2019-07-01 16:03:13 UTC

can you add the CVE / bug to the references, then reassign back to us.

Comment 4 Oliver Neukum 2019-07-02 09:02:53 UTC

According to MITRE this CVE is spurious due to being a duplicate.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12983

Our fix has long since been pushed as bsc#1134848
What is to be done?

Comment 5 Marcus Meissner 2019-08-14 11:11:35 UTC

mark as dup of bug 1134848

*** This bug has been marked as a duplicate of bug 1134848 ***