Out-of-bounds read in Linux kernel - CVE-2020-10769

Vulnerability identifier: #VU50427

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-10769

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the crypto_authenc_extractkeys() function in crypto/authenc.c in the IPsec Cryptographic algorithm's module "authenc". A local low-privileged user can run a specially crafted program to trigger an out-of-bounds read error and crash the system.

Linux kernel
ClevOS
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise High Availability
BIG-IP SSLO
BIG-IP DDHD
BIG-IP
BIG-IP Advanced WAF
BIG-IP AFM
BIG-IP GTM
BIG-IP ASM
BIG-IP LTM
BIG-IP Analytics
BIG-IP APM
BIG-IP PEM
BIG-IP FPS
BIG-IP AAM
BIG-IP DNS
BIG-IP Link Controller
kgraft-patch-4_4_180-94_164-default-debuginfo
kgraft-patch-4_4_180-94_164-default
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-default-base
kernel-default-base-debuginfo
kernel-default-debuginfo
kernel-default-debugsource
kernel-default-devel
kernel-syms
kernel-devel
kernel-macros
kernel-source
kernel-default
ocfs2-kmp-default-debuginfo
ocfs2-kmp-default
gfs2-kmp-default-debuginfo
gfs2-kmp-default
dlm-kmp-default-debuginfo
dlm-kmp-default
cluster-md-kmp-default-debuginfo
cluster-md-kmp-default
kernel-default-man
kernel-default-kgraft
kernel-alt (Red Hat package)
Data Computing Appliance (DCA)
IBM QRadar Network Security
Session Smart Router

Install updates from vendor's website.

Linux kernel - update to 5.0.0
kgraft-patch-4_4_180-94_164-default-debuginfo - update to 1-4.3.2
kgraft-patch-4_4_180-94_164-default - update to 1-4.3.2
kernel (Red Hat package) - update to 3.10.0-1160.11.1.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.11.1.rt56.1145.el7
Data Computing Appliance (DCA) - update to 4.3.0.0
kernel-default-base - addressed in versions 4.4.121-92.175.2, 4.4.180-94.164.3
kernel-default-base-debuginfo - addressed in versions 4.4.121-92.175.2, 4.4.180-94.164.3
kernel-default-debuginfo - addressed in versions 4.4.121-92.175.2, 4.4.180-94.164.3
kernel-default-debugsource - addressed in versions 4.4.121-92.175.2, 4.4.180-94.164.3
kernel-default-devel - addressed in versions 4.4.121-92.175.2, 4.4.180-94.164.3
kernel-syms - addressed in versions 4.4.121-92.175.2, 4.4.180-94.164.2
kernel-devel - addressed in versions 4.4.121-92.175.2, 4.4.180-94.164.2
kernel-macros - addressed in versions 4.4.121-92.175.2, 4.4.180-94.164.2
kernel-source - addressed in versions 4.4.121-92.175.2, 4.4.180-94.164.2
kernel-default - addressed in versions 4.4.121-92.175.2, 4.4.180-94.164.3
ocfs2-kmp-default-debuginfo - update to 4.4.180-94.164.3
ocfs2-kmp-default - update to 4.4.180-94.164.3
gfs2-kmp-default-debuginfo - update to 4.4.180-94.164.3
gfs2-kmp-default - update to 4.4.180-94.164.3
dlm-kmp-default-debuginfo - update to 4.4.180-94.164.3
dlm-kmp-default - update to 4.4.180-94.164.3
cluster-md-kmp-default-debuginfo - update to 4.4.180-94.164.3
cluster-md-kmp-default - update to 4.4.180-94.164.3
kernel-default-man - update to 4.4.180-94.164.3
kernel-default-kgraft - update to 4.4.180-94.164.3
kernel-alt (Red Hat package) - update to 4.14.0-115.29.1.el7a
IBM QRadar Network Security - addressed in versions 5.4.0.17, 5.5.0.12
Session Smart Router - addressed in versions 5.4.7, 5.5.3

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1708775;
• https://lkml.org/lkml/2019/1/21/675

• Denial of service in Linux kernel
• Local denial of service in Linux kernel in F5 BIG-IP products
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel
• ClevOS update for IBM Cloud Object Storage Systems
• Multiple vulnerabilities in Juniper Networks Session Smart Router
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in IBM QRadar Network Security
• Red Hat Enterprise Linux 7 update for kernel
• Red Hat Enterprise Linux 7 update for kernel-rt
• Red Hat Enterprise Linux 7 update for kernel-alt