CVE-2019-11811: kernel: use-after-free in IPMI

[Bruce Jones]

CVE-2019-11811
status : fixed
cvss2Score : 10
Attack Vector: N
Access Complexity : L
Autentication: N
Availability Impact :C
Affected packages:
['kernel', 'kernel-tools', 'kernel-tools-libs', 'perf', 'python-perf']
An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c.
https://nvd.nist.gov/vuln/detail/CVE-2019-11811

[Ghada Khalil (gkhalil)]

This was previously reported in https://bugs.launchpad.net/starlingx/+bug/1840778
After further investigation, it was determined that StarlingX is not really vulnerable. See the details in the LP above. I think we can close this as a duplicate.

[Ghada Khalil (gkhalil)]

Re-opening: Even though the current StarlingX kernel version (957.21.3) is not vulnerable to this CVE, the vulnerability maybe introduced when picking up a newer kernel to address the following CVEs:
https://bugs.launchpad.net/starlingx/+bug/1849206
https://bugs.launchpad.net/starlingx/+bug/1847817

Note: All open kernel CVEs should be investigated and addressed together.

[Lin Shuicheng (shuicheng)]

We are upgrading kernel to kernel-3.10.0-1062.1.2.el7.src.rpm currently, and I confirm below fix is already included in this srpm.
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=401e7e88d4ef80188ffa07095ac00456f901b8c4

So no extra work is needed for this CVE.

[Victor Manuel Rodriguez Bahena (vm-rod25)]

Ok, Thanks :)

[Lin Shuicheng (shuicheng)]

Since both previous 957 and latest 1062 kernel doesn't have this CE issue.
I will close this issue as Invalid.
Feel free to add your comments if you have other idea.
Thanks.

[Ghada Khalil (gkhalil)]

The vuls scanning tool is reporting this CVE for StarlingX. Given we are now picking up a version of the kernel (1062) that has the fix, I prefer to have this CVE / launchpad referenced in that commit and marked as Fix Released when the commit is merged.

[Ghada Khalil (gkhalil)]

Assigning to Robin to link to his commits with the kernel upversion to 1062:
https://review.opendev.org/#/c/695359/
https://review.opendev.org/#/c/695358/
https://review.opendev.org/#/c/695355/