CVE-2020-14305: High severity Google Android vulnerability
A flaw memory corruption in the Linux kernel Voice over IP h323-conntrack-nat module was found. An attacker could use this flaw to corrupt the memory. For reproducing, need to establish connection to the port 1720 that is being used during call setup negotiation. For ipv4 no crash (kernel panic), so for detecting corruption need to use ipv6. The corruption happens for fields of struct nfctext (usually nfctnat is located after nfconnhelp, but possibly nfconnnat and other that located in memory right after nfconnhelp). In most cases the overlapping bytes were zero (if without debug options), so attacker cannot control directly what is being written to the corrupted memory, but at least one numerical value could be modified with tpktlen (so attacker can change TCP/IP packet payload size to control what is being written to some corrupted Int value).
The patch is: https://patchwork.ozlabs.org/project/netfilter-devel/patch/c2385b5c-309c-cc64-2e10-a0ef62897502@virtuozzo.com/
Other sources
An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.12 - Configuration
Do not use IPv6 on affected hardware until the kernel has been updated (disable IPv6 on the host until you upgrade to a fixed kernel).
IPv6 networking on affected hosts use_ipv6 = disabled - Configuration
Unload the h323-conntrack-nat module (nf_conntrack_h323) if currently loaded and blacklist it to prevent future loading (unload the module and add it to the system's module blacklist).
Linux kernel module nf_conntrack_h323 loaded/blacklisted = unloaded and blacklisted - Compensating control
Block or restrict IPv6 access to TCP port 1720 at network perimeter/firewalls or otherwise restrict access to port 1720 for IPv6 to mitigate exploitation until hosts are updated.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-14305?
The severity of CVE-2020-14305 is high as it allows an unauthenticated remote user to crash the system, leading to a denial of service.
How do I fix CVE-2020-14305?
To fix CVE-2020-14305, upgrade to the patched versions of the Linux kernel provided by your distribution, such as kernel-rt version 0:3.10.0-1160.rt56.1131.el7 or kernel version 0:3.10.0-1160.el7.
What type of vulnerability is CVE-2020-14305?
CVE-2020-14305 is an out-of-bounds memory write flaw in the Linux kernel’s Voice Over IP H.323 connection tracking functionality.
Which systems are affected by CVE-2020-14305?
CVE-2020-14305 affects various versions of the Linux kernel, including certain versions of the Red Hat kernel and the Linux kernel up to 4.11.12.
Can CVE-2020-14305 be exploited remotely?
Yes, CVE-2020-14305 can be exploited by an unauthenticated remote user, potentially leading to a system crash.