CVE-2019-15916: kernel: memory leak in register_queue_kobjects

[Ghada Khalil]

CVE-2019-15916: kernel: memory leak in register_queue_kobjects

CVSSv2: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)

Description:
An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service.

References:
https://nvd.nist.gov/vuln/detail/CVE-2019-15916
https://access.redhat.com/errata/RHSA-2020:1016
https://<email address hidden>/msg05890.html

New RPM version:
kernel-3.10.0-1127.el7.src.rpm

Reported By: StarlingX May 2020 CVE Scan

[Ghada Khalil (gkhalil)]

This CVE is applicable to stx.3.0 (r/stx.3.0 branch) only.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: r/stx.3.0
Review: https://review.opendev.org/739836

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: r/stx.3.0
Review: https://review.opendev.org/739855

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: r/stx.3.0
Review: https://review.opendev.org/739856

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/739836
Committed: https://git.openstack.org/cgit/starlingx/tools/commit/?id=c95bc837a92f2af9b098d25af7579cdeb3d4fb7f
Submitter: Zuul
Branch: r/stx.3.0

commit c95bc837a92f2af9b098d25af7579cdeb3d4fb7f
Author: Jim Somerville <email address hidden>
Date: Tue Jul 7 15:14:22 2020 -0400

    CVE-2019-15916: kernel: memory leak in register_queue_kobjects

    Upversion the kernel to CentOS 7.8 which is 3.10.0-1127.13.1 .

    As per the Mellanox support matrix, this means that we also
    have to move the Mellanox driver and associated components
    forward to version 5.0, subversion 2.1.8.1 .

    Passed platform sanity tests on a Wind River lab equipped with
    Mellanox cards.

    Change-Id: I8ff82e742b765248b87d3b07f6a4e36a3a7d70fc
    Partial-Bug: 1881429
    Signed-off-by: Jim Somerville <email address hidden>

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/739855
Committed: https://git.openstack.org/cgit/starlingx/integ/commit/?id=a15f22d1d58d1f21a69a7071e960efc37254e14d
Submitter: Zuul
Branch: r/stx.3.0

commit a15f22d1d58d1f21a69a7071e960efc37254e14d
Author: Jim Somerville <email address hidden>
Date: Tue Jul 7 17:04:04 2020 -0400

    CVE-2019-15916: kernel: memory leak in register_queue_kobjects

    Upversion the kernel to CentOS 7.8 which is 3.10.0-1127.13.1 .

    We get to drop the ipvs memory leak patch because it is now
    incorporated.

    On std, we remove the rcuc patch because it wasn't being
    used and thus was just polluting the patch directory.

    On rt, we also get rid of the robustify CFS bandwidth locking
    patch because it is already incorporated.

    Minor tweaks for compilation.

    Change-Id: I5ceac098d2487c77138e3ee2d39e80b2e20b7af0
    Partial-Bug: 1881429
    Depends-On: https://review.opendev.org/#/c/739836
    Signed-off-by: Jim Somerville <email address hidden>

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/739856
Committed: https://git.openstack.org/cgit/starlingx/integ/commit/?id=450e00a2cc134c5a8a4b20bdda1fdcafc60b1857
Submitter: Zuul
Branch: r/stx.3.0

commit 450e00a2cc134c5a8a4b20bdda1fdcafc60b1857
Author: Jim Somerville <email address hidden>
Date: Tue Jul 7 17:16:27 2020 -0400

    Upversion Mellanox driver to 5.0-2.1.8.1

    The upgrade of the kernel to CentOS 7.8 forced us
    to move forward the Mellanox driver as per the Mellanox
    compatibility matrix.

    This also includes the libibverbs and rdma-core components.

    Tested by running platform sanity on a Wind River lab
    with Mellanox network cards.

    Change-Id: Ifee8cbbb9f90f7e881c674beb4d5d1894368c17e
    Closes-Bug: 1881429
    Depends-On: https://review.opendev.org/#/c/739836
    Signed-off-by: Jim Somerville <email address hidden>

[Ghada Khalil (gkhalil)]

This is now resolved in the r/stx.3.0 branch. Marking the LP as Fix Released (it only gets automatically updated for the master branch)