CVE-2020-12770: Use After Free
A vulnerability was found in sgwrite in drivers/scsi/sg.c in SCSI generic (sg) driver subsystem. An attacker with a local access and special user privilege (or root) can cause a denial of service (DoS) if allocated list is not cleaned with invalid (Sgfd sfp) pointer at the time of failure, failing this can even cause a kernel internal information leak problem.
Reference and upstream commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=83c6f2390040f188cc25b270b4befeb5628c1aee
Other sources
A vulnerability was found in sgwrite in drivers/scsi/sg.c in the SCSI generic (sg) driver subsystem. This flaw allows an attacker with local access and special user or root privileges to cause a denial of service if the allocated list is not cleaned with an invalid (Sgfd sfp) pointer at the time of failure, also possibly causing a kernel internal information leak problem.
An issue was discovered in the Linux kernel through 5.6.11. sgwrite lacks an sgremoverequest call in a certain failure case, aka CID-83c6f2390040.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-693.81.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-957.65.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.40.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.rt7.54.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch CID-83c6f2390040 - Compensating control
Apply the upstream fix corresponding to commit CID-83c6f2390040 by ensuring sg_write failure paths invoke the missing sg_remove_request call so the allocated list is cleaned and the invalid (Sg_fd *sfp) pointer is not left uncleared, preventing DoS and potential kernel internal information leak.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-12770?
CVE-2020-12770 has a severity rating that may lead to Denial of Service (DoS) under specific conditions.
How do I fix CVE-2020-12770?
To fix CVE-2020-12770, upgrade to the recommended kernel versions from the vendors as specified in the security advisories.
What systems are affected by CVE-2020-12770?
CVE-2020-12770 affects multiple versions of the Linux kernel and specific Linux distributions including Red Hat, Fedora, and Debian.
Can CVE-2020-12770 be exploited remotely?
CVE-2020-12770 requires local access and special user privileges to be exploited, making it less likely to be exploited remotely.
What is the potential impact of CVE-2020-12770?
The impact of CVE-2020-12770 includes potential Denial of Service (DoS), affecting system availability.