Use-after-free in Linux kernel - CVE-2020-10690

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU30292

Use-after-free in Linux kernel - CVE-2020-10690

Published: May 8, 2020 / Updated: July 17, 2020


Vulnerability identifier: #VU30292
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-10690
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged user to execute arbitrary code.

There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode.


Affected software

Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Workstation
Slackware Linux
Ubuntu
Oracle VM Server for x86
kernel (Red Hat package)
kernel-rt (Red Hat package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-generic-lpae-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-powerpc-e500mc-lts-xenial (Ubuntu package)
linux-image-powerpc-smp-lts-xenial (Ubuntu package)
linux-image-powerpc64-emb-lts-xenial (Ubuntu package)
linux-image-powerpc64-smp-lts-xenial (Ubuntu package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-powerpc64-smp (Ubuntu package)
linux-image-powerpc64-emb (Ubuntu package)
linux-image-powerpc-smp (Ubuntu package)
linux-image-powerpc-e500mc (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-4.4.0-185-generic (Ubuntu package)
linux-image-4.4.0-185-powerpc64-smp (Ubuntu package)
linux-image-4.4.0-185-generic-lpae (Ubuntu package)
linux-image-4.4.0-185-powerpc64-emb (Ubuntu package)
linux-image-4.4.0-185-powerpc-smp (Ubuntu package)
linux-image-4.4.0-185-lowlatency (Ubuntu package)
linux-image-4.4.0-185-powerpc-e500mc (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1074-aws (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-1076-kvm (Ubuntu package)
linux-image-4.4.0-1110-aws (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.4.0-1135-raspi2 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.4.0-1139-snapdragon (Ubuntu package)
linux-4.4.227/kernel-generic
linux-4.4.227/kernel-huge
linux-4.4.227/kernel-modules
linux-4.4.227/kernel-headers

How to mitigate CVE-2020-10690

Install update from vendor's website.

Linux kernel - update to 5.5
kernel (Red Hat package) - update to 3.10.0-1160.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.rt56.1131.el7
linux-image-generic-lts-xenial (Ubuntu package) - update to 4.4.0.185.162
linux-image-generic-lpae-lts-xenial (Ubuntu package) - update to 4.4.0.185.162
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to 4.4.0.185.162
linux-image-powerpc-e500mc-lts-xenial (Ubuntu package) - update to 4.4.0.185.162
linux-image-powerpc-smp-lts-xenial (Ubuntu package) - update to 4.4.0.185.162
linux-image-powerpc64-emb-lts-xenial (Ubuntu package) - update to 4.4.0.185.162
linux-image-powerpc64-smp-lts-xenial (Ubuntu package) - update to 4.4.0.185.162
linux-image-virtual-lts-xenial (Ubuntu package) - update to 4.4.0.185.162
linux-image-lowlatency (Ubuntu package) - update to 4.4.0.185.191
linux-image-virtual (Ubuntu package) - update to 4.4.0.185.191
linux-image-powerpc64-smp (Ubuntu package) - update to 4.4.0.185.191
linux-image-powerpc64-emb (Ubuntu package) - update to 4.4.0.185.191
linux-image-powerpc-smp (Ubuntu package) - update to 4.4.0.185.191
linux-image-powerpc-e500mc (Ubuntu package) - update to 4.4.0.185.191
linux-image-generic-lpae (Ubuntu package) - update to 4.4.0.185.191
linux-image-generic (Ubuntu package) - update to 4.4.0.185.191
linux-image-4.4.0-185-generic (Ubuntu package) - addressed in versions 4.4.0-185.215, 4.4.0-185.215~14.04.1
linux-image-4.4.0-185-powerpc64-smp (Ubuntu package) - addressed in versions 4.4.0-185.215, 4.4.0-185.215~14.04.1
linux-image-4.4.0-185-generic-lpae (Ubuntu package) - addressed in versions 4.4.0-185.215, 4.4.0-185.215~14.04.1
linux-image-4.4.0-185-powerpc64-emb (Ubuntu package) - addressed in versions 4.4.0-185.215, 4.4.0-185.215~14.04.1
linux-image-4.4.0-185-powerpc-smp (Ubuntu package) - addressed in versions 4.4.0-185.215, 4.4.0-185.215~14.04.1
linux-image-4.4.0-185-lowlatency (Ubuntu package) - addressed in versions 4.4.0-185.215, 4.4.0-185.215~14.04.1
linux-image-4.4.0-185-powerpc-e500mc (Ubuntu package) - addressed in versions 4.4.0-185.215, 4.4.0-185.215~14.04.1
linux-image-aws (Ubuntu package) - addressed in versions 4.4.0.1074.71, 4.4.0.1110.114
linux-image-4.4.0-1074-aws (Ubuntu package) - update to 4.4.0-1074.78
linux-image-kvm (Ubuntu package) - update to 4.4.0.1076.74
linux-image-4.4.0-1076-kvm (Ubuntu package) - update to 4.4.0-1076.83
linux-image-4.4.0-1110-aws (Ubuntu package) - update to 4.4.0-1110.121
linux-image-raspi2 (Ubuntu package) - update to 4.4.0.1135.135
linux-image-4.4.0-1135-raspi2 (Ubuntu package) - update to 4.4.0-1135.144
linux-image-snapdragon (Ubuntu package) - update to 4.4.0.1139.131
linux-image-4.4.0-1139-snapdragon (Ubuntu package) - update to 4.4.0-1139.147
linux-4.4.227/kernel-generic - update to 4.4.227
linux-4.4.227/kernel-huge - update to 4.4.227
linux-4.4.227/kernel-modules - update to 4.4.227
linux-4.4.227/kernel-headers - update to 4.4.227_smp

External References

Related Security Bulletins