CVE-2020-14351: Use After Free
First published: Mon Aug 03 2020(Updated: )
A flaw in the Linux kernels perf subsystem could allow a local attacker with permission to monitor perf events (either through CAP_SYS_ADMIN or a modification to /proc/sys/kernel/perf_event_paranoid ) to create an environment where a use-after-free flaw could take place allowing them to corrupt memory and possibly escalate privileges. The Red Hat Enterprise Linux 7.2 and later kernels default to a safe /proc/sys/kernel/perf_event_paranoid setting, however local administrators may have reason to change the setting to allow non privileged users to monitor performance statistics. Upstream kernel documentation recommends not modifying this value and instead creating a perf_users group as outlined in ther documentation: <a href="https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html">https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:3.10.0-1160.21.1.rt56.1158.el7 | 0:3.10.0-1160.21.1.rt56.1158.el7 |
| redhat/kernel | <0:3.10.0-1160.21.1.el7 | 0:3.10.0-1160.21.1.el7 |
| redhat/kernel | <0:3.10.0-514.86.1.el7 | 0:3.10.0-514.86.1.el7 |
| redhat/kernel | <0:3.10.0-693.84.1.el7 | 0:3.10.0-693.84.1.el7 |
| redhat/kernel | <0:3.10.0-957.70.1.el7 | 0:3.10.0-957.70.1.el7 |
| redhat/kernel | <0:3.10.0-1062.46.1.el7 | 0:3.10.0-1062.46.1.el7 |
| redhat/kernel-rt | <0:4.18.0-240.15.1.rt7.69.el8_3 | 0:4.18.0-240.15.1.rt7.69.el8_3 |
| redhat/kernel | <0:4.18.0-240.15.1.el8_3 | 0:4.18.0-240.15.1.el8_3 |
| redhat/kernel | <0:4.18.0-147.43.1.el8_1 | 0:4.18.0-147.43.1.el8_1 |
| redhat/kernel-rt | <0:4.18.0-193.46.1.rt13.96.el8_2 | 0:4.18.0-193.46.1.rt13.96.el8_2 |
| redhat/kernel | <0:4.18.0-193.46.1.el8_2 | 0:4.18.0-193.46.1.el8_2 |
| Linux Linux kernel | <5.8.17 | |
| Redhat Enterprise Linux | =7.0 | |
| Redhat Enterprise Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| redhat/kernel | <5.8.17 | 5.8.17 |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.11.10-1 6.12.5-1 |
Remedy
While there is no way to disable the perf subsystem on Linux systems, reducing or removing users access to the perf events can effectively mitigate this flaw. Upstream kernel documentation has been written regarding this mechanism: https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-14351 https://nvd.nist.gov/vuln/detail/CVE-2020-14351
- https://bugzilla.redhat.com/show_bug.cgi?id=1862849
- https://access.redhat.com/errata/RHSA-2021:0857
- https://access.redhat.com/errata/RHSA-2021:0856
- https://access.redhat.com/errata/RHSA-2021:0848
- https://access.redhat.com/errata/RHSA-2021:1267
- https://access.redhat.com/errata/RHSA-2021:0878
- https://access.redhat.com/errata/RHSA-2021:1028
- https://access.redhat.com/errata/RHSA-2021:0537
- https://access.redhat.com/errata/RHSA-2021:0558
- https://access.redhat.com/errata/RHSA-2021:0686
- https://access.redhat.com/errata/RHSA-2021:0774
- https://access.redhat.com/errata/RHSA-2021:0765
- https://access.redhat.com/security/cve/cve-2020-14351
- https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
- https://launchpad.net/bugs/cve/CVE-2020-14351
- https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1896213
- https://lore.kernel.org/lkml/20200910104153.1672460-1-jolsa@kernel.org/
- https://security-tracker.debian.org/tracker/CVE-2020-14351
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14351
- https://nvd.nist.gov/vuln/detail/CVE-2020-14351
- https://ubuntu.com/security/CVE-2020-14351
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-index
- agent/software-canonical-lookup
- agent/author
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-14351
- collector/nvd-cve
- source/NVD
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/references
- agent/tags
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0
- version/redhat enterprise linux/8.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- package-manager/debian