[oss-security] CVE-2018-6554 and CVE-2018-6555: Linux kernel: irda memory leak and use after free

[Tyler Hicks]

Two issues were discovered in the irda subsystem within the Linux
kernel.

The irda subsystem has been removed from the upstream kernel starting in
v4.17 but it is present in many distro kernels and the stable kernel tree.

Memory leak in the irda_bind function in net/irda/af_irda.c and later
in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17
allows local users to cause a denial of service (memory consumption) by
repeatedly binding an AF_IRDA socket. (CVE-2018-6554)

The irda_setsockopt function in net/irda/af_irda.c and later in
drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17
allows local users to cause a denial of service (ias_object
use-after-free and system crash) or possibly have unspecified other
impact via an AF_IRDA socket. (CVE-2018-6555)

I've sent the fixes to the stable kernel list but I don't yet see my
submissions in the list archive on Spinics. Here are the equivalent
versions of the patches against the Ubuntu kernel:

https://lists.ubuntu.com/archives/kernel-team/2018-September/095134.html
(>= 4.14)

https://lists.ubuntu.com/archives/kernel-team/2018-September/095137.html
(< 4.14)

Tyler

[Vladis Dronov]

Post by Tyler Hicks
I've sent the fixes to the stable kernel list but I don't yet see my
submissions in the list archive on Spinics.

For the sake of completeness:

https://www.spinics.net/lists/stable/msg255033.html - [STABLE <= 4.13][PATCH 0/2] IRDA fixes

https://www.spinics.net/lists/stable/msg255029.html - [STABLE 4.14+][PATCH 0/2] IRDA fixes

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer