CVE-2020-12657: Use After Free
First published: Tue May 05 2020(Updated: )
A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able to groom system memory to cause kernel memory corruption and possible privilege escalation by abusing a race condition in the IO scheduler.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-193.6.3.rt13.59.el8_2 | 0:4.18.0-193.6.3.rt13.59.el8_2 |
| redhat/kernel | <0:4.18.0-193.6.3.el8_2 | 0:4.18.0-193.6.3.el8_2 |
| redhat/kernel | <0:4.18.0-80.23.2.el8_0 | 0:4.18.0-80.23.2.el8_0 |
| redhat/kernel | <0:4.18.0-147.20.1.el8_1 | 0:4.18.0-147.20.1.el8_1 |
| Linux Linux kernel | <5.6.5 | |
| redhat/kernel | <5.6.5 | 5.6.5 |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.11.10-1 6.12.5-1 |
Remedy
The default io scheduler for Red Hat Enterprise Linux 8 is the mq-deadline scheduler, however it can be configured to any of the available schedulers available on the system on a per-device basis. The schedulers in use can be verified by the block devices entry in sysfs, for example for "sda": # cat /sys/block/sda/queue/scheduler [mq-deadline] kyber bfq none All block devices in the system will need to be changed to be mitigated. If the system workload requires bfq, this may not be an acceptable workaround however some systems may find changing io schedulers to be an acceptable workaround until system updates can be applied. See https://access.redhat.com/solutions/3756041 for how to configure the io scheduler persistently across system reboots or contact Red Hat Global Support Services.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-12657 https://nvd.nist.gov/vuln/detail/CVE-2020-12657
- https://bugzilla.redhat.com/show_bug.cgi?id=1832866
- https://access.redhat.com/errata/RHSA-2020:2428
- https://access.redhat.com/errata/RHSA-2020:2427
- https://access.redhat.com/errata/RHSA-2020:2567
- https://access.redhat.com/errata/RHSA-2020:2429
- https://access.redhat.com/errata/RHSA-2020:2667
- https://access.redhat.com/errata/RHSA-2020:2669
- https://access.redhat.com/security/cve/cve-2020-12657
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.5
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2f95fa5c955d0a9987ffdc3a095e2f4e62c5f2a9
- https://github.com/torvalds/linux/commit/2f95fa5c955d0a9987ffdc3a095e2f4e62c5f2a9
- https://patchwork.kernel.org/patch/11447049/
- https://security.netapp.com/advisory/ntap-20200608-0001/
- https://usn.ubuntu.com/4363-1/
- https://usn.ubuntu.com/4367-1/
- https://usn.ubuntu.com/4368-1/
- https://usn.ubuntu.com/4369-1/
- https://launchpad.net/bugs/cve/CVE-2020-12657
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2f95fa5c955d0a9987ffdc3a095e2f4e62c5f2a9
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1832867
- https://access.redhat.com/solutions/3756041
- https://git.kernel.org/linus/2f95fa5c955d0a9987ffdc3a095e2f4e62c5f2a9
- https://security-tracker.debian.org/tracker/CVE-2020-12657
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12657
- https://nvd.nist.gov/vuln/detail/CVE-2020-12657
- https://ubuntu.com/security/CVE-2020-12657
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-12657
- agent/software-canonical-lookup
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/tags
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- package-manager/debian