CVE-2020-12464: Use After Free
A use-after-free flaw was found in usbsgcancel in drivers/usb/core/message.c in USB core subsystem. This flaw could allow a local attacker with special user privilege (or root) to crash the system due to a race problem in scatter-gather cancellation and transfer completion in usbsgwait. This vulnerability can even lead to a kernel information leak problem .
Here usbsgcancel() does not take any reference to the transfer and there is nothing to prevent the URBs from being deallocated while the routine is trying to use them.
Taking a reference by incrementing the transfer's io->count field while the cancellation is in progress and decrementing it afterwards can be way to address this. The transfer's URBs are not deallocated until io->complete is triggered, which happens when io->count reaches zero. ~~~ BUG: KASAN: use-after-free in atomicread include/asm-generic/atomic-instrumented.h:26 [inline] BUG: KASAN: use-after-free in usbhcdunlinkurb+0x5f/0x170 drivers/usb/core/hcd.c:1607 Read of size 4 at addr ffff888065379610 by task kworker/u4:1/27 ~~~
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8 https://lkml.org/lkml/2020/3/23/52
Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=056ad39ee9253873522f6469c3364964a322912b
Other sources
usbsgcancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.6.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CID-056ad39ee925 - Compensating control
Mitigate exposure to the usb_sg_cancel use-after-free race by reducing unprivileged/privileged local access paths to trigger scatter-gather USB cancellation/transfer completion (e.g., restrict USB device access where applicable), as the issue can be exploited by a local attacker with special user privilege (or root) to crash the system and potentially leak kernel information.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12464?
CVE-2020-12464 is classified as a high-severity vulnerability due to its potential to cause system crashes.
How do I fix CVE-2020-12464?
To fix CVE-2020-12464, it is recommended to upgrade to patched versions of the Linux kernel or the specific software affected.
What software is affected by CVE-2020-12464?
CVE-2020-12464 affects multiple versions of the Linux kernel and certain NetApp products such as Active IQ Unified Manager and cloud backup solutions.
What type of attack does CVE-2020-12464 facilitate?
CVE-2020-12464 enables a local attacker with special user privileges to exploit a use-after-free flaw in the USB core subsystem.
How can I determine if my system is vulnerable to CVE-2020-12464?
You can check the version of your Linux kernel or affected software to determine if it falls within the vulnerable ranges specified for CVE-2020-12464.