Security Bulletin: Multiple vulnerabiities in the IBM 4769 Developer's Toolkit. CVE-2019-20811, CVE-2020-0466, CVE-2021-0920, CVE-2021-3347, CVE-2018-19985, CVE-2018-20169, CVE-2019-13648, CVE-2019-15916, CVE-2019-19527

Summary

IBM customers who use the IBM 4769 Developer’s Toolkit to create custom firmware images may be affected by one or more vulnerabilities that were announced against the Linux kernel.

Vulnerability Details

CVEID:CVE-2019-20811
**DESCRIPTION:**Linux Kernel could provide weaker than expected security, caused by mishandling of reference count in the rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c. A local attacker could exploit this vulnerability to launch further attacks on the system.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183253 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

CVEID:CVE-2020-0466
**DESCRIPTION:**Google Android could allow a local attacker to gain elevated privileges on the system, caused by a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/193397 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2021-0920
**DESCRIPTION:**Google Android could allow a local attacker to gain elevated privileges on the system, caused by a use after free flaw due to a race condition in unix_scm_to_skb of af_unix.c. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215673 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:CVE-2021-3347
**DESCRIPTION:**Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a kernel stack use-after-free during fault handling in PI futexes. An attacker could exploit this vulnerability to gain elevated privileges and execute arbitrary code in the kernel.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/195798 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2018-19985
**DESCRIPTION:**Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds read in the hso_get_config_data function in drivers/net/usb/hso.c. A local attacker could exploit this vulnerability to cause the system to crash.
CVSS Base score: 4.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/160204 for the current score.
CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2018-20169
**DESCRIPTION:**Linux Kernel is vulnerable to a denial of service, caused by improper size validation by the __usb_get_extra_descriptor function in drivers/usb/core/usb.c in the USB subsystem. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/154367 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2019-13648
**DESCRIPTION:**Linux Kernel is vulnerable to a denial of service, caused by a flaw in arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c when hardware transactional memory is disabled. By using a sigreturn() system call with crafted signal frame, a local attacker could exploit this vulnerability to cause the system to crash.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/164506 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2019-15916
**DESCRIPTION:**Linux Kernel is vulnerable to a denial of service, caused by a memory leak in register_queue_kobjects() in net/core/net-sysfs.c. A local attacker could exploit this vulnerability to cause the system to crash.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166559 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2019-19527
**DESCRIPTION:**Linux Kernel is vulnerable to a denial of service, caused by a use-after-free condition in drivers/hid/usbhid/hiddev.c. By connecting a specially-crafted USB device, an attacker could exploit this vulnerability to cause a kernel panic.
CVSS Base score: 4.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/172524 for the current score.
CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability by upgrading to the latest toolkit

Customers should contact their toolkit provider to obtain the latest toolkit.

Notes:

The Linux kernel resides within segment-2 on an IBM 4769 Cryptographic Adapter so toolkit customers will need to apply the “seg2” CLU file provided with the updated toolkit.

Workarounds and Mitigations

IBM recommends that all toolkit customers upgrade to the latest version of the toolkit.

However, since the listed vulnerabilities affect specific subsystems and APIs within the Linux kernel (please refer to the individual CVEs for details), firmware that does not interact with those subsystems would be unaffected by the listed CVEs. For example, custom firmware that does not enable the IBM 4769’s USB port would be unaffected by CVE-2018-19985, CVE-2018-20169 and CVE-2019-19527. Likewise, custom firmware that does not make use of “Fast Userspace Mutexes” via the futex() system call would be unaffected by CVE-2021-3347. Therefore, toolkit customers may wish to examine their custom firmware code to decide whether they might be affected by the listed CVEs.