CVE-2020-12657: Use After Free

Published May 5, 2020
·
Updated

A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able to groom system memory to cause kernel memory corruption and possible privilege escalation by abusing a race condition in the IO scheduler.

Other sources

An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfqidleslicetimerbody.

— Ubuntu

An issue was discovered in the Linux kernels implementation of BFQ IO scheduler. A local user who is able to groom system memory may be able to cause kernel memory corruption and possibly privilege escalation through abusing a race condition in the IO scheduler.

— Red Hat

Affected Software

62 affected componentsFixes available
redhat/kernel-rt<0:4.18.0-193.6.3.rt13.59.el8_2
0:4.18.0-193.6.3.rt13.59.el8_2
redhat/kernel<0:4.18.0-193.6.3.el8_2
0:4.18.0-193.6.3.el8_2
redhat/kernel<0:4.18.0-80.23.2.el8_0
0:4.18.0-80.23.2.el8_0
redhat/kernel<0:4.18.0-147.20.1.el8_1
0:4.18.0-147.20.1.el8_1
Linux Linux kernel<5.6.5
redhat/kernel<5.6.5
5.6.5
debian/linux
6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1
ubuntu/linux-azure<4.15.0-1083.93~14.04.1
4.15.0-1083.93~14.04.1
ubuntu/linux-aws-hwe<4.15.0-1067.71~16.04.1
4.15.0-1067.71~16.04.1
ubuntu/linux-azure<4.15.0-1083.93~16.04.1
4.15.0-1083.93~16.04.1
ubuntu/linux-gcp<4.15.0-1071.81~16.04.1
4.15.0-1071.81~16.04.1
ubuntu/linux-hwe<4.15.0-101.102~16.04.1
4.15.0-101.102~16.04.1
ubuntu/linux-oracle<4.15.0-1039.43~16.04.1
4.15.0-1039.43~16.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux<4.15.0-101.102
4.15.0-101.102
ubuntu/linux-aws<4.15.0-1067.71
4.15.0-1067.71
ubuntu/linux-aws-5.3<5.3.0-1019.21~18.04.1
5.3.0-1019.21~18.04.1
ubuntu/linux-azure-4.15<4.15.0-1083.93
4.15.0-1083.93
ubuntu/linux-azure-5.3<5.3.0-1022.23~18.04.1
5.3.0-1022.23~18.04.1
ubuntu/linux-gcp-5.3<5.3.0-1020.22~18.04.1
5.3.0-1020.22~18.04.1
ubuntu/linux-gke-4.15<4.15.0-1059.62
4.15.0-1059.62
ubuntu/linux-gke-5.0<5.0.0-1037.38
5.0.0-1037.38
ubuntu/linux-gke-5.3<5.3.0-1020.22~18.04.1
5.3.0-1020.22~18.04.1
ubuntu/linux-hwe<5.3.0-53.47~18.04.1
5.3.0-53.47~18.04.1
ubuntu/linux-kvm<4.15.0-1060.61
4.15.0-1060.61
ubuntu/linux-oem<4.15.0-1081.91
4.15.0-1081.91
ubuntu/linux-oem-osp1<5.0.0-1052.57
5.0.0-1052.57
ubuntu/linux-oracle<4.15.0-1039.43
4.15.0-1039.43
ubuntu/linux-oracle-5.3<5.3.0-1018.20~18.04.1
5.3.0-1018.20~18.04.1
ubuntu/linux-raspi2<4.15.0-1062.66
4.15.0-1062.66
ubuntu/linux-raspi2-5.3<5.3.0-1026.28~18.04.1
5.3.0-1026.28~18.04.1
ubuntu/linux-snapdragon<4.15.0-1079.86
4.15.0-1079.86
ubuntu/linux-aws-5.0*
ubuntu/linux-azure*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-edge*
ubuntu/linux-hwe-edge*
ubuntu/linux-oracle-5.0*
ubuntu/linux-aws-fips<4.15.0-2018.18
4.15.0-2018.18
ubuntu/linux-azure-fips<4.15.0-2006.7
4.15.0-2006.7
ubuntu/linux-fips<4.15.0-1029.34
4.15.0-1029.34
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-31.35
5.4.0-31.35
ubuntu/linux-aws<5.4.0-1011.11
5.4.0-1011.11
ubuntu/linux-azure<5.4.0-1012.12
5.4.0-1012.12
ubuntu/linux-gcp<5.4.0-1011.11
5.4.0-1011.11
ubuntu/linux-kvm<5.4.0-1011.11
5.4.0-1011.11
ubuntu/linux-oem-5.6<5.6.0-1010.10
5.6.0-1010.10
ubuntu/linux-oracle<5.4.0-1011.11
5.4.0-1011.11
ubuntu/linux-raspi<5.4.0-1011.11
5.4.0-1011.11
ubuntu/linux-riscv<5.4.0-26.30
5.4.0-26.30
ubuntu/linux-azure-fde*
ubuntu/linux-gke*
ubuntu/linux-raspi2*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-193.6.3.rt13.59.el8_2
  2. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-193.6.3.el8_2
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-80.23.2.el8_0
  4. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-147.20.1.el8_1
  5. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 5.6.5
  6. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
  7. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1083.93~14.04.1
  8. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1067.71~16.04.1
  9. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1083.93~16.04.1
  10. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1071.81~16.04.1
  11. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-101.102~16.04.1
  12. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1039.43~16.04.1
  13. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-101.102
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1067.71
  15. Upgrade

    Upgrade ubuntu/linux-aws-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1019.21~18.04.1
  16. Upgrade

    Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1083.93
  17. Upgrade

    Upgrade ubuntu/linux-azure-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1022.23~18.04.1
  18. Upgrade

    Upgrade ubuntu/linux-gcp-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1020.22~18.04.1
  19. Upgrade

    Upgrade ubuntu/linux-gke-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1059.62
  20. Upgrade

    Upgrade ubuntu/linux-gke-5.0 to a version that resolves this vulnerability.

    Fixed in 5.0.0-1037.38
  21. Upgrade

    Upgrade ubuntu/linux-gke-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1020.22~18.04.1
  22. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 5.3.0-53.47~18.04.1
  23. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1060.61
  24. Upgrade

    Upgrade ubuntu/linux-oem to a version that resolves this vulnerability.

    Fixed in 4.15.0-1081.91
  25. Upgrade

    Upgrade ubuntu/linux-oem-osp1 to a version that resolves this vulnerability.

    Fixed in 5.0.0-1052.57
  26. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1039.43
  27. Upgrade

    Upgrade ubuntu/linux-oracle-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1018.20~18.04.1
  28. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1062.66
  29. Upgrade

    Upgrade ubuntu/linux-raspi2-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1026.28~18.04.1
  30. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.15.0-1079.86
  31. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2018.18
  32. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2006.7
  33. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1029.34
  34. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-31.35
  35. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1011.11
  36. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1012.12
  37. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1011.11
  38. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1011.11
  39. Upgrade

    Upgrade ubuntu/linux-oem-5.6 to a version that resolves this vulnerability.

    Fixed in 5.6.0-1010.10
  40. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1011.11
  41. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1011.11
  42. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 5.4.0-26.30
  43. Configuration

    Change the I/O scheduler for all block devices from bfq to mq-deadline, or another available non-BFQ scheduler, and configure the change persistently across system reboots.

    Linux block devices I/O scheduler = mq-deadline

Event History

May 5, 2020
CVE Published
12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·06:01 AM
Data Sourced
via MITRE·06:01 AM
Description
Data Sourced
via OSV·07:15 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·07:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
May 7, 2020
Data Sourced
via Red Hat·12:23 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2020-12657?

CVE-2020-12657 has been classified with a high severity level due to its potential for privilege escalation and kernel memory corruption.

2

How do I fix CVE-2020-12657?

To mitigate CVE-2020-12657, you should update to the latest kernel version provided by your distribution, such as kernel-rt 0:4.18.0-193.6.3.rt13.59.el8_2 or higher.

3

Who is affected by CVE-2020-12657?

CVE-2020-12657 affects users running specific versions of the Linux kernel, including those versions prior to the recommended patches.

4

What systems are impacted by CVE-2020-12657?

The vulnerability primarily impacts Linux distributions such as Red Hat and Debian that utilize the BFQ IO scheduler.

5

Is CVE-2020-12657 exploitable remotely?

CVE-2020-12657 is not considered remotely exploitable as it requires local access to exploit the vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203