Bug 1131430 - (CVE-2019-3837) VUL-1: CVE-2019-3837: kernel-source: memory leak in tcp_recvmsg() with NET_DMA
(CVE-2019-3837)
VUL-1: CVE-2019-3837: kernel-source: memory leak in tcp_recvmsg() with NET_DMA
Status: IN_PROGRESS
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Minor
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/228705/
CVSSv3:SUSE:CVE-2019-3837:6.1:(AV:L/A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-04-03 12:59 UTC by Marcus Meissner
Modified: 2022-12-19 13:47 UTC (History)
7 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2019-04-03 12:59:33 UTC
CVE-2019-3837

via oss-sec

From: Vladis Dronov <vdronov@redhat.com>
Date: Wed, 3 Apr 2019 08:29:50 -0400 (EDT)
Subject: [oss-security] CVE-2019-3837: RHEL6: memory leak in tcp_recvmsg() with NET_DMA

Heololo,

It was found that the net_dma code in tcp_recvmsg() in the RHEL6 kernel is
thread-unsafe. So an unprivileged multi-threaded userspace application
calling recvmsg() for the same network socket in parallel executed on
ioatdma-enabled hardware with net_dma enabled can leak the memory,
crash the host leading to a denial-of-service, or cause a random memory
corruption.

This flaw was assigned an id of CVE-2019-3837.

net_dma was disabled in the upstream Linux kernel since v3.13-rc5 by
the 77873803363c "net_dma: mark broken" and then completely removed
by the 7bced397510a "net_dma: simple removal".

So this flaw affects RHEL-6 only and any (LTS) Linux kernel (of any
distribution) which has not backported the net_dma disabling commits
mentioned above.

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security | Senior Software Engineer


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-3837
Comment 1 Michal Kubeček 2019-04-04 08:28:03 UTC
3.12 based branches got commit 77873803363c (marking CONFIG_NET_DMA as broken)
via 3.12.7 stable updated so that we don't have CONFIG_NET_DMA enabled on any
kernel branch based on 3.12 or newer. Branches based on 3.0 and older have
CONFIG_NET_DMA enabled and will need a fix.

With the information available (which is not very specific), the easiest way
to handle the problem (without breaking kABI) would be modifying the receive
path code to behave as if NET_DMA was disabled (or at least behave as if
sysctl_tcp_dma_copybreak was infinity). A bit more work but cleaner and safer
approacho would be to drop all code fragments inside "#ifdef NET_DMA" (except
member declarations in kABI protected structures).

More proper approach woud probably require making the access to IOAT DMA
exclusive somehow but as one of the reasons for dropping the feature was that
it didn't really help much, I don't think it's worth the effort and, more
important, the risk.
Comment 8 Michal Kubeček 2022-11-02 18:49:06 UTC
Submitted a patch that drops most of "#ifdef CONFIG_NET_DMA" sections from
networking code but preserves kABI into cve/linux-3.0. No newer branch is
affected as all have the code gone already (since mainline 3.18-rc1).

Reassigning back to security team.