Use-after-free in Linux kernel - CVE-2020-10690

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU30292

Use-after-free in Linux kernel - CVE-2020-10690

Published: May 8, 2020 / Updated: July 17, 2020


Vulnerability identifier: #VU30292
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-10690
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available
Affected software:
Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Workstation
Slackware Linux
Ubuntu
Oracle VM Server for x86
kernel (Red Hat package)
kernel-rt (Red Hat package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-generic-lpae-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-powerpc-e500mc-lts-xenial (Ubuntu package)
linux-image-powerpc-smp-lts-xenial (Ubuntu package)
linux-image-powerpc64-emb-lts-xenial (Ubuntu package)
linux-image-powerpc64-smp-lts-xenial (Ubuntu package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-powerpc64-smp (Ubuntu package)
linux-image-powerpc64-emb (Ubuntu package)
linux-image-powerpc-smp (Ubuntu package)
linux-image-powerpc-e500mc (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-4.4.0-185-generic (Ubuntu package)
linux-image-4.4.0-185-powerpc64-smp (Ubuntu package)
linux-image-4.4.0-185-generic-lpae (Ubuntu package)
linux-image-4.4.0-185-powerpc64-emb (Ubuntu package)
linux-image-4.4.0-185-powerpc-smp (Ubuntu package)
linux-image-4.4.0-185-lowlatency (Ubuntu package)
linux-image-4.4.0-185-powerpc-e500mc (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1074-aws (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-1076-kvm (Ubuntu package)
linux-image-4.4.0-1110-aws (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.4.0-1135-raspi2 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.4.0-1139-snapdragon (Ubuntu package)
linux-4.4.227/kernel-generic
linux-4.4.227/kernel-huge
linux-4.4.227/kernel-modules
linux-4.4.227/kernel-headers

Detailed vulnerability description

The vulnerability allows a local privileged user to execute arbitrary code.

There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode.


How to mitigate CVE-2020-10690

Install update from vendor's website.

Sources