Bug 1159281 (CVE-2019-19807) - VUL-1: CVE-2019-19807: kernel-source: use-after-free caused by erroneous code refactoring in sound/core/timer.c
Summary: VUL-1: CVE-2019-19807: kernel-source: use-after-free caused by erroneous code...
Status: RESOLVED UPSTREAM
Alias: CVE-2019-19807
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Minor
Target Milestone: ---
Assignee: E-mail List
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/249077/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-12-16 12:36 UTC by Alexandros Toptsoglou
Modified: 2024-06-25 14:12 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2019-12-16 12:36:52 UTC 
CVE-2019-19807

In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free
caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to
snd_timer_open and snd_timer_close_locked. The timeri variable was originally
intended to be for a newly created timer instance, but was used for a different
purpose after refactoring.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19807
https://github.com/torvalds/linux/commit/e7af6307a8a54f0b873960b32b6a644f2d0fbd97
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e7af6307a8a54f0b873960b32b6a644f2d0fbd97
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11
Comment 1 Alexandros Toptsoglou 2019-12-16 12:37:34 UTC 
It seems that non of our codestreams is affected closing as Upstream
Comment 2 Alexandros Toptsoglou 2019-12-16 12:37:47 UTC 
.
Comment 3 Takashi Iwai 2019-12-16 12:57:18 UTC 
Actually the bug was in 5.3 kernel, so SLE15-SP2 would hit, but the fix was already included.  I'll update the patch reference.