Resource exhaustion in Linux kernel - CVE-2020-12655

Vulnerability identifier: #VU28165

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12655

CWE-ID: CWE-400

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in "xfs_agf_verify" in "fs/xfs/libxfs/xfs_alloc.c" file. A local user can use an XFS v5 image with crafted metadata, trigger resource exhaustion and perform a denial of service (DoS) attack.

Linux kernel
Anolis OS
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for ARM 64
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Server for SAP
Ubuntu
Fedora
Oracle VM Server for x86
kgraft-patch-4_4_180-94_150-default
kgraft-patch-4_4_180-94_150-default-debuginfo
kernel-devel
kernel-syms
kernel-default-devel
kernel-default-debugsource
kernel-default-debuginfo
kernel-default-base-debuginfo
kernel-default-base
kernel-default
kernel-source
kernel-macros
kernel-default-kgraft
kernel-default-man
cluster-md-kmp-default
cluster-md-kmp-default-debuginfo
dlm-kmp-default
dlm-kmp-default-debuginfo
gfs2-kmp-default
gfs2-kmp-default-debuginfo
ocfs2-kmp-default
ocfs2-kmp-default-debuginfo
kernel-alt (Red Hat package)
linux-image-generic (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-4.15.0-115-generic (Ubuntu package)
linux-image-4.15.0-115-generic-lpae (Ubuntu package)
linux-image-4.15.0-115-lowlatency (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1051-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1067-gke (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.15.0-1068-raspi2 (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1072-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1080-aws (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-4.15.0-1081-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1084-snapdragon (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-edge (Ubuntu package)
linux-image-4.15.0-1093-azure (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-4.15.0-1094-oem (Ubuntu package)
kernel (Red Hat package)
kernel
kernel-debug
kernel-debug-devel
kernel-headers
kernel-tools
kernel-tools-libs
kernel-tools-libs-devel
perf
python-perf
bpftool
linux-image-5.3.0-65-lowlatency (Ubuntu package)
linux-image-5.3.0-65-generic (Ubuntu package)
linux-image-gkeop-5.3 (Ubuntu package)
linux-image-gke-5.3 (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.3.0-1033-gke (Ubuntu package)
linux-image-5.3.0-1033-aws (Ubuntu package)
linux-image-5.3.0-1035-azure (Ubuntu package)
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-45-generic (Ubuntu package)
linux-image-5.4.0-45-generic-lpae (Ubuntu package)
linux-image-5.4.0-45-lowlatency (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-gkeop-5.4 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1016-raspi (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-aws-edge (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-5.4.0-1022-aws (Ubuntu package)
linux-image-5.4.0-1022-oracle (Ubuntu package)
linux-image-5.4.0-1022-gcp (Ubuntu package)
linux-image-5.4.0-1023-azure (Ubuntu package)

Install updates from vendor's website.

Linux kernel - update to 5.6.11
kgraft-patch-4_4_180-94_150-default - update to 1-4.3.1
kgraft-patch-4_4_180-94_150-default-debuginfo - update to 1-4.3.1
kernel-devel - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-syms - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-devel - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-debugsource - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-debuginfo - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-base-debuginfo - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-base - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-source - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-macros - addressed in versions 4.4.121-92.161.1, 4.4.180-94.150.1
kernel-default-kgraft - update to 4.4.180-94.150.1
kernel-default-man - update to 4.4.180-94.150.1
cluster-md-kmp-default - update to 4.4.180-94.150.1
cluster-md-kmp-default-debuginfo - update to 4.4.180-94.150.1
dlm-kmp-default - update to 4.4.180-94.150.1
dlm-kmp-default-debuginfo - update to 4.4.180-94.150.1
gfs2-kmp-default - update to 4.4.180-94.150.1
gfs2-kmp-default-debuginfo - update to 4.4.180-94.150.1
ocfs2-kmp-default - update to 4.4.180-94.150.1
ocfs2-kmp-default-debuginfo - update to 4.4.180-94.150.1
kernel-alt (Red Hat package) - update to 4.14.0-115.29.1.el7a
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.115.103, 5.4.0.45.49
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.115.103, 5.4.0.45.49
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.115.103, 5.4.0.45.49
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.115.103, 5.4.0.45.49
linux-image-4.15.0-115-generic (Ubuntu package) - update to 4.15.0-115.116~16.04.1
linux-image-4.15.0-115-generic-lpae (Ubuntu package) - update to 4.15.0-115.116~16.04.1
linux-image-4.15.0-115-lowlatency (Ubuntu package) - update to 4.15.0-115.116~16.04.1
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1051.42, 5.4.0.1022.7, 5.4.0.1022.20
linux-image-4.15.0-1051-oracle (Ubuntu package) - addressed in versions 4.15.0-1051.55, 4.15.0-1051.55~16.04.1
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1051.62
linux-image-4.15.0-1067-gke (Ubuntu package) - update to 4.15.0-1067.70
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1067.71
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1067.71, 4.15.0.1081.83, 5.4.0.1022.20
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.15.0.1068.66, 5.4.0.1016.51
linux-image-4.15.0-1068-raspi2 (Ubuntu package) - update to 4.15.0-1068.72
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1072.68, 5.4.0.1021.20
linux-image-4.15.0-1072-kvm (Ubuntu package) - update to 4.15.0-1072.73
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1080.77
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1080.82
linux-image-4.15.0-1080-aws (Ubuntu package) - addressed in versions 4.15.0-1080.84, 4.15.0-1080.84~16.04.1
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1081.83, 5.4.0.1022.9, 5.4.0.1022.20
linux-image-4.15.0-1081-gcp (Ubuntu package) - addressed in versions 4.15.0-1081.92, 4.15.0-1081.92~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1081.99
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1084.87
linux-image-4.15.0-1084-snapdragon (Ubuntu package) - update to 4.15.0-1084.92
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1093.67
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1093.70, 4.15.0.1093.88, 5.3.0.1035.31, 5.4.0.1023.7, 5.4.0.1023.22
linux-image-azure-edge (Ubuntu package) - update to 4.15.0.1093.88
linux-image-4.15.0-1093-azure (Ubuntu package) - addressed in versions 4.15.0-1093.103, 4.15.0-1093.103~14.04.1, 4.15.0-1093.103~16.04.1
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.1094.98, 5.4.0.45.49
linux-image-4.15.0-1094-oem (Ubuntu package) - update to 4.15.0-1094.104
kernel (Red Hat package) - update to 4.18.0-240.el8
kernel - update to 4.19.91-26
kernel-debug - update to 4.19.91-26
kernel-debug-devel - update to 4.19.91-26
kernel-devel - update to 4.19.91-26
kernel-headers - update to 4.19.91-26
kernel-tools - update to 4.19.91-26
kernel-tools-libs - update to 4.19.91-26
kernel-tools-libs-devel - update to 4.19.91-26
perf - update to 4.19.91-26
python-perf - update to 4.19.91-26
bpftool - update to 4.19.91-26
linux-image-5.3.0-65-lowlatency (Ubuntu package) - update to 5.3.0-65.59
linux-image-5.3.0-65-generic (Ubuntu package) - update to 5.3.0-65.59
linux-image-gkeop-5.3 (Ubuntu package) - update to 5.3.0.65.121
linux-image-gke-5.3 (Ubuntu package) - update to 5.3.0.1033.18
linux-image-aws (Ubuntu package) - addressed in versions 5.3.0.1033.32, 5.4.0.1022.23
linux-image-5.3.0-1033-gke (Ubuntu package) - update to 5.3.0-1033.35
linux-image-5.3.0-1033-aws (Ubuntu package) - update to 5.3.0-1033.35
linux-image-5.3.0-1035-azure (Ubuntu package) - update to 5.3.0-1035.36
linux-image-oem-osp1 (Ubuntu package) - update to 5.4.0.45.49
linux-image-5.4.0-45-generic (Ubuntu package) - update to 5.4.0-45.49~18.04.2
linux-image-5.4.0-45-generic-lpae (Ubuntu package) - update to 5.4.0-45.49~18.04.2
linux-image-5.4.0-45-lowlatency (Ubuntu package) - update to 5.4.0-45.49~18.04.2
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-gkeop-5.4 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-5.4.0-1016-raspi (Ubuntu package) - update to 5.4.0-1016.17~18.04.1
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1016.20
linux-image-raspi (Ubuntu package) - update to 5.4.0.1016.51
linux-image-aws-edge (Ubuntu package) - update to 5.4.0.1022.8
linux-image-gke-5.4 (Ubuntu package) - update to 5.4.0.1022.9
linux-image-5.4.0-1022-aws (Ubuntu package) - update to 5.4.0-1022.22~18.04.1
linux-image-5.4.0-1022-oracle (Ubuntu package) - update to 5.4.0-1022.22~18.04.1
linux-image-5.4.0-1022-gcp (Ubuntu package) - update to 5.4.0-1022.22~18.04.1
linux-image-5.4.0-1023-azure (Ubuntu package) - update to 5.4.0-1023.23~18.04.1
kernel - addressed in versions 5.6.13-100.fc30, 5.6.13-200.fc31, 5.6.13-300.fc32

• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d0c7feaf87678371c2c09b3709400be416b2dc62
• https://github.com/torvalds/linux/commit/d0c7feaf87678371c2c09b3709400be416b2dc62
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES5C6ZCMALBEBMKNNCTBSLLSYGFZG3FF/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IO5XIQSRI747P4RVVTNX7TUPEOCF4OPU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZ2X3TM6RGRUS3KZAS26IJO5XGU7TBBR/
• https://lore.kernel.org/linux-xfs/20200221153803.GP9506@magnolia/

• Denial of service in Linux kernel
• Multiple vulnerabilities in Oracle VM Server for x86
• Anolis OS update for kernel(ANCK)4.19
• Ubuntu update for linux-aws-5.3
• Ubuntu update for linux
• Ubuntu update for linux
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 7 update for kernel-alt
• Fedora 32 update for kernel
• Fedora 31 update for kernel
• Fedora 30 update for kernel
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel