Memory leak in Linux kernel - CVE-2020-29371

Vulnerability identifier: #VU90488

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-29371

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to memory leak within the romfs_dev_read() function in fs/romfs/storage.c. A local user can gain access to sensitive information.

Linux kernel
openEuler
Ubuntu
python2-perf
perf
kernel-source
python2-perf-debuginfo
kernel-tools-debuginfo
kernel-devel
kernel-tools-devel
bpftool-debuginfo
python3-perf
python3-perf-debuginfo
perf-debuginfo
kernel-debuginfo
kernel-tools
kernel-debugsource
bpftool
kernel
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.6.0-1048-oem (Ubuntu package)

Install update from vendor's website.

Linux kernel - update to 5.8.4
python2-perf - update to 4.19.90-2012.5.0.0054
perf - update to 4.19.90-2012.5.0.0054
kernel-source - update to 4.19.90-2012.5.0.0054
python2-perf-debuginfo - update to 4.19.90-2012.5.0.0054
kernel-tools-debuginfo - update to 4.19.90-2012.5.0.0054
kernel-devel - update to 4.19.90-2012.5.0.0054
kernel-tools-devel - update to 4.19.90-2012.5.0.0054
bpftool-debuginfo - update to 4.19.90-2012.5.0.0054
python3-perf - update to 4.19.90-2012.5.0.0054
python3-perf-debuginfo - update to 4.19.90-2012.5.0.0054
perf-debuginfo - update to 4.19.90-2012.5.0.0054
kernel-debuginfo - update to 4.19.90-2012.5.0.0054
kernel-tools - update to 4.19.90-2012.5.0.0054
kernel-debugsource - update to 4.19.90-2012.5.0.0054
bpftool - update to 4.19.90-2012.5.0.0054
kernel - update to 4.19.90-2012.5.0.0054
linux-image-oem-20.04 (Ubuntu package) - update to 5.6.0.1048.44
linux-image-5.6.0-1048-oem (Ubuntu package) - update to 5.6.0-1048.52

• https://bugs.chromium.org/p/project-zero/issues/detail?id=2077
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.4
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2935e0a3cec1ffa558eea90db6279cff83aa3592
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bcf85fcedfdd17911982a3e3564fcfec7b01eebd

• Memory leak in Linux kernel romfs
• Ubuntu update for linux-oem-5.6
• openEuler 20.03 LTS update for kernel