CVE-2020-27835: Use After Free
A flaw use after free in the Linux kernel infiniband hfi1 driver was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system.
Other sources
A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system.
A vulnerability was found in kernel, where Intel OPA Gen1 adapter" (CONFIGINFINIBANDHFI1) for Kernel versions after these two commits e0cf75deab81 ("IB/hfi1: Fix mmstruct use after free") 3faa3d9a308e ("IB/hfi1: Make use of mm consistent") , there is a potential problem where if a child process with access to the parents file handle calls an IOCTL or write or close, the value of the mm will be that of the parent, not the child process. This can lead to use-after-free security issue.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.rt7.72.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.el8 - Upgrade
Upgrade
redhat/Linux kernelto a version that resolves this vulnerability.Fixed in 5.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.8to a version that resolves this vulnerability.Fixed in 5.8.0-44.50~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.8to a version that resolves this vulnerability.Fixed in 5.8.0-17.19~20.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.10-rc6 - Compensating control
Prevent the hfi1 kernel module from being loaded; denylist the module to prevent it from loading automatically.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-27835?
CVE-2020-27835 has a medium severity rating due to its potential to crash the system.
How do I fix CVE-2020-27835?
To fix CVE-2020-27835, upgrade to kernel versions 5.10-rc6 or later, or apply the relevant patches provided by your distribution.
Which versions are affected by CVE-2020-27835?
CVE-2020-27835 affects Linux kernel versions prior to 5.10-rc6, including earlier versions like 5.10-rc1 through 5.9.
Who is affected by CVE-2020-27835?
Local users on systems running the vulnerable versions of the Linux kernel with Infiniband hfi1 driver are primarily affected by CVE-2020-27835.
Can external users exploit CVE-2020-27835?
CVE-2020-27835 is a local privilege escalation vulnerability and cannot be exploited remotely by external users.