CVE-2020-29660: Use After Free
First published: Fri Dec 04 2020(Updated: )
A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-348.rt7.130.el8 | 0:4.18.0-348.rt7.130.el8 |
| redhat/kernel | <0:4.18.0-348.el8 | 0:4.18.0-348.el8 |
| Google Android | ||
| ubuntu/linux | <4.15.0-136.140 | 4.15.0-136.140 |
| ubuntu/linux | <5.4.0-66.74 | 5.4.0-66.74 |
| ubuntu/linux | <5.8.0-44.50 | 5.8.0-44.50 |
| ubuntu/linux | <3.13.0-188.239 | 3.13.0-188.239 |
| ubuntu/linux | <5.10~ | 5.10~ |
| ubuntu/linux | <4.4.0-203.235 | 4.4.0-203.235 |
| ubuntu/linux-aws | <4.15.0-1094.101 | 4.15.0-1094.101 |
| ubuntu/linux-aws | <5.4.0-1038.40 | 5.4.0-1038.40 |
| ubuntu/linux-aws | <5.8.0-1024.26 | 5.8.0-1024.26 |
| ubuntu/linux-aws | <4.4.0-1086.90 | 4.4.0-1086.90 |
| ubuntu/linux-aws | <5.10~ | 5.10~ |
| ubuntu/linux-aws | <4.4.0-1122.136 | 4.4.0-1122.136 |
| ubuntu/linux-aws-5.0 | <5.10~ | 5.10~ |
| ubuntu/linux-aws-5.11 | <5.10~ | 5.10~ |
| ubuntu/linux-aws-5.13 | <5.10~ | 5.10~ |
| ubuntu/linux-aws-5.3 | <5.10~ | 5.10~ |
| ubuntu/linux-aws-5.4 | <5.4.0-1038.40~18.04.1 | 5.4.0-1038.40~18.04.1 |
| ubuntu/linux-aws-5.4 | <5.10~ | 5.10~ |
| ubuntu/linux-aws-5.8 | <5.10~ | 5.10~ |
| ubuntu/linux-aws-hwe | <5.10~ | 5.10~ |
| ubuntu/linux-aws-hwe | <4.15.0-1094.101~16.04.1 | 4.15.0-1094.101~16.04.1 |
| ubuntu/linux-azure | <5.4.0-1040.42 | 5.4.0-1040.42 |
| ubuntu/linux-azure | <5.8.0-1023.25 | 5.8.0-1023.25 |
| ubuntu/linux-azure | <4.15.0-1108.120~14.04.1 | 4.15.0-1108.120~14.04.1 |
| ubuntu/linux-azure | <5.10~ | 5.10~ |
| ubuntu/linux-azure | <4.15.0-1108.120~16.04.1 | 4.15.0-1108.120~16.04.1 |
| ubuntu/linux-azure-4.15 | <4.15.0-1108.120 | 4.15.0-1108.120 |
| ubuntu/linux-azure-4.15 | <5.10~ | 5.10~ |
| ubuntu/linux-azure-5.11 | <5.10~ | 5.10~ |
| ubuntu/linux-azure-5.13 | <5.10~ | 5.10~ |
| ubuntu/linux-azure-5.3 | <5.10~ | 5.10~ |
| ubuntu/linux-azure-5.4 | <5.4.0-1040.42~18.04.1 | 5.4.0-1040.42~18.04.1 |
| ubuntu/linux-azure-5.4 | <5.10~ | 5.10~ |
| ubuntu/linux-azure-edge | <5.10~ | 5.10~ |
| ubuntu/linux-azure-fde | <5.4.0-1040.42 | 5.4.0-1040.42 |
| ubuntu/linux-azure-fde | <5.10~ | 5.10~ |
| ubuntu/linux-bluefield | <5.4.0-1011.14 | 5.4.0-1011.14 |
| ubuntu/linux-bluefield | <5.10~ | 5.10~ |
| ubuntu/linux-dell300x | <4.15.0-1012.16 | 4.15.0-1012.16 |
| ubuntu/linux-dell300x | <5.10~ | 5.10~ |
| ubuntu/linux-fips | <5.10~ | 5.10~ |
| ubuntu/linux-gcp | <5.4.0-1037.40 | 5.4.0-1037.40 |
| ubuntu/linux-gcp | <5.8.0-1023.24 | 5.8.0-1023.24 |
| ubuntu/linux-gcp | <5.10~ | 5.10~ |
| ubuntu/linux-gcp | <4.15.0-1093.106~16.04.1 | 4.15.0-1093.106~16.04.1 |
| ubuntu/linux-gcp-4.15 | <4.15.0-1093.106 | 4.15.0-1093.106 |
| ubuntu/linux-gcp-4.15 | <5.10~ | 5.10~ |
| ubuntu/linux-gcp-5.11 | <5.10~ | 5.10~ |
| ubuntu/linux-gcp-5.13 | <5.10~ | 5.10~ |
| ubuntu/linux-gcp-5.3 | <5.10~ | 5.10~ |
| ubuntu/linux-gcp-5.4 | <5.4.0-1037.40~18.04.1 | 5.4.0-1037.40~18.04.1 |
| ubuntu/linux-gcp-5.8 | <5.10~ | 5.10~ |
| ubuntu/linux-gcp-edge | <5.10~ | 5.10~ |
| ubuntu/linux-gke | <5.4.0-1036.38 | 5.4.0-1036.38 |
| ubuntu/linux-gke | <5.10~ | 5.10~ |
| ubuntu/linux-gke-4.15 | <4.15.0-1079.84 | 4.15.0-1079.84 |
| ubuntu/linux-gke-4.15 | <5.10~ | 5.10~ |
| ubuntu/linux-gke-5.0 | <5.10~ | 5.10~ |
| ubuntu/linux-gke-5.3 | <5.10~ | 5.10~ |
| ubuntu/linux-gke-5.4 | <5.4.0-1036.38~18.04.1 | 5.4.0-1036.38~18.04.1 |
| ubuntu/linux-gke-5.4 | <5.10~ | 5.10~ |
| ubuntu/linux-gkeop | <5.4.0-1010.11 | 5.4.0-1010.11 |
| ubuntu/linux-gkeop | <5.10~ | 5.10~ |
| ubuntu/linux-gkeop-5.4 | <5.4.0-1010.11~18.04.1 | 5.4.0-1010.11~18.04.1 |
| ubuntu/linux-gkeop-5.4 | <5.10~ | 5.10~ |
| ubuntu/linux-hwe | <5.10~ | 5.10~ |
| ubuntu/linux-hwe | <4.15.0-136.140~16.04.1 | 4.15.0-136.140~16.04.1 |
| ubuntu/linux-hwe-5.11 | <5.10~ | 5.10~ |
| ubuntu/linux-hwe-5.13 | <5.10~ | 5.10~ |
| ubuntu/linux-hwe-5.4 | <5.4.0-66.74~18.04.2 | 5.4.0-66.74~18.04.2 |
| ubuntu/linux-hwe-5.4 | <5.10~ | 5.10~ |
| ubuntu/linux-hwe-5.8 | <5.8.0-44.50~20.04.1 | 5.8.0-44.50~20.04.1 |
| ubuntu/linux-hwe-5.8 | <5.10~ | 5.10~ |
| ubuntu/linux-hwe-edge | <5.10~ | 5.10~ |
| ubuntu/linux-ibm | <5.10~ | 5.10~ |
| ubuntu/linux-ibm-5.4 | <5.10~ | 5.10~ |
| ubuntu/linux-intel-5.13 | <5.10~ | 5.10~ |
| ubuntu/linux-kvm | <4.15.0-1085.87 | 4.15.0-1085.87 |
| ubuntu/linux-kvm | <5.4.0-1033.34 | 5.4.0-1033.34 |
| ubuntu/linux-kvm | <5.8.0-1019.21 | 5.8.0-1019.21 |
| ubuntu/linux-kvm | <5.10~ | 5.10~ |
| ubuntu/linux-kvm | <4.4.0-1088.97 | 4.4.0-1088.97 |
| ubuntu/linux-lowlatency | <5.10~ | 5.10~ |
| ubuntu/linux-lts-trusty | <5.10~ | 5.10~ |
| ubuntu/linux-lts-xenial | <4.4.0-203.235~14.04.1 | 4.4.0-203.235~14.04.1 |
| ubuntu/linux-lts-xenial | <5.10~ | 5.10~ |
| ubuntu/linux-oem | <5.10~ | 5.10~ |
| ubuntu/linux-oem-5.10 | <5.10~ | 5.10~ |
| ubuntu/linux-oem-5.13 | <5.10~ | 5.10~ |
| ubuntu/linux-oem-5.17 | <5.10~ | 5.10~ |
| ubuntu/linux-oem-5.6 | <5.6.0-1048.52 | 5.6.0-1048.52 |
| ubuntu/linux-oem-5.6 | <5.10~ | 5.10~ |
| ubuntu/linux-oem-osp1 | <5.10~ | 5.10~ |
| ubuntu/linux-oracle | <4.15.0-1065.73 | 4.15.0-1065.73 |
| ubuntu/linux-oracle | <5.4.0-1038.41 | 5.4.0-1038.41 |
| ubuntu/linux-oracle | <5.8.0-1021.22 | 5.8.0-1021.22 |
| ubuntu/linux-oracle | <5.10~ | 5.10~ |
| ubuntu/linux-oracle | <4.15.0-1065.73~16.04.1 | 4.15.0-1065.73~16.04.1 |
| ubuntu/linux-oracle-5.0 | <5.10~ | 5.10~ |
| ubuntu/linux-oracle-5.11 | <5.10~ | 5.10~ |
| ubuntu/linux-oracle-5.13 | <5.10~ | 5.10~ |
| ubuntu/linux-oracle-5.3 | <5.10~ | 5.10~ |
| ubuntu/linux-oracle-5.4 | <5.4.0-1038.41~18.04.1 | 5.4.0-1038.41~18.04.1 |
| ubuntu/linux-raspi | <5.4.0-1029.32 | 5.4.0-1029.32 |
| ubuntu/linux-raspi | <5.8.0-1016.19 | 5.8.0-1016.19 |
| ubuntu/linux-raspi | <5.10~ | 5.10~ |
| ubuntu/linux-raspi-5.4 | <5.4.0-1029.32~18.04.1 | 5.4.0-1029.32~18.04.1 |
| ubuntu/linux-raspi-5.4 | <5.10~ | 5.10~ |
| ubuntu/linux-raspi2 | <4.15.0-1079.84 | 4.15.0-1079.84 |
| ubuntu/linux-raspi2 | <5.10~ | 5.10~ |
| ubuntu/linux-raspi2 | <4.4.0-1146.156 | 4.4.0-1146.156 |
| ubuntu/linux-raspi2-5.3 | <5.10~ | 5.10~ |
| ubuntu/linux-riscv | <5.8.0-17.19 | 5.8.0-17.19 |
| ubuntu/linux-riscv | <5.10~ | 5.10~ |
| ubuntu/linux-riscv-5.11 | <5.10~ | 5.10~ |
| ubuntu/linux-riscv-5.8 | <5.8.0-17.19~20.04.1 | 5.8.0-17.19~20.04.1 |
| ubuntu/linux-riscv-5.8 | <5.10~ | 5.10~ |
| ubuntu/linux-snapdragon | <4.15.0-1096.105 | 4.15.0-1096.105 |
| ubuntu/linux-snapdragon | <5.10~ | 5.10~ |
| ubuntu/linux-snapdragon | <4.4.0-1150.160 | 4.4.0-1150.160 |
| Linux Linux kernel | <=5.9.13 | |
| Fedoraproject Fedora | =32 | |
| Fedoraproject Fedora | =33 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Broadcom Fabric Operating System | ||
| All of | ||
| Netapp Solidfire Baseboard Management Controller Firmware | ||
| Netapp Solidfire Baseboard Management Controller | ||
| All of | ||
| Netapp H410c Firmware | ||
| Netapp H410c | ||
| All of | ||
| Netapp A700s Firmware | ||
| Netapp A700s | ||
| All of | ||
| Netapp 8300 Firmware | ||
| Netapp 8300 | ||
| All of | ||
| Netapp 8700 Firmware | ||
| Netapp 8700 | ||
| All of | ||
| Netapp A400 Firmware | ||
| Netapp A400 | ||
| Netapp Solidfire Baseboard Management Controller Firmware | ||
| Netapp Solidfire Baseboard Management Controller | ||
| Netapp H410c Firmware | ||
| Netapp H410c | ||
| Netapp A700s Firmware | ||
| Netapp A700s | ||
| Netapp 8300 Firmware | ||
| Netapp 8300 | ||
| Netapp 8700 Firmware | ||
| Netapp 8700 | ||
| Netapp A400 Firmware | ||
| Netapp A400 | ||
| debian/linux | 4.19.249-2 4.19.304-1 5.10.209-2 5.10.216-1 6.1.76-1 6.1.90-1 6.7.12-1 6.8.9-1 |
Remedy
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-29660 https://nvd.nist.gov/vuln/detail/CVE-2020-29660
- https://bugzilla.redhat.com/show_bug.cgi?id=1906522
- https://access.redhat.com/errata/RHSA-2021:4140
- https://access.redhat.com/errata/RHSA-2021:4356
- https://access.redhat.com/security/cve/cve-2020-29660
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c8bcd9c5be24fb9e6132e97da5a35e55a83e36b9
- http://www.openwall.com/lists/oss-security/2020/12/10/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZ7OAKAEFAXQRGBZK4LYUWINCD3D2XCL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BOB25SU6XUL4TNP7KB63WNZSYTIYFDPP/
- https://security.netapp.com/advisory/ntap-20210122-0001/
- https://www.debian.org/security/2021/dsa-4843
- https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html
- https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
- http://packetstormsecurity.com/files/164950/Kernel-Live-Patch-Security-Notice-LSN-0082-1.html
- https://launchpad.net/bugs/cve/CVE-2020-29660
- https://android.googlesource.com/kernel/common/+/c8bcd9c5be24fb9e6132e97da5a35e55a83e36b9
- https://source.android.com/docs/security/bulletin/2021-10-01 (Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BOB25SU6XUL4TNP7KB63WNZSYTIYFDPP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZ7OAKAEFAXQRGBZK4LYUWINCD3D2XCL/
- https://git.kernel.org/linus/c8bcd9c5be24fb9e6132e97da5a35e55a83e36b9
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2125
- https://googleprojectzero.blogspot.com/2021/10/how-simple-linux-kernel-memory.html
- https://security-tracker.debian.org/tracker/CVE-2020-29660
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1906523
- https://ubuntu.com/security/notices/USN-4748-1
- https://ubuntu.com/security/notices/USN-4749-1
- https://ubuntu.com/security/notices/USN-4750-1
- https://ubuntu.com/security/notices/USN-4751-1
- https://ubuntu.com/security/notices/USN-4752-1
- https://ubuntu.com/security/notices/USN-5130-1
- https://www.cve.org/CVERecord?id=CVE-2020-29660
- https://nvd.nist.gov/vuln/detail/CVE-2020-29660
- https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
- https://ubuntu.com/security/CVE-2020-29660
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/first-publish-date
- agent/author
- collector/android-source
- agent/software-canonical-lookup-request
- agent/remedy
- agent/severity
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-29660
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/software-canonical-lookup
- agent/references
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- package-manager/redhat
- vendor/google
- canonical/google android
- package-manager/ubuntu
- package-manager/debian
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/5.9.13
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/32
- version/fedoraproject fedora/33
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/netapp
- canonical/netapp active iq unified manager vmware vsphere
- vendor/broadcom
- canonical/broadcom fabric operating system
- canonical/netapp solidfire baseboard management controller firmware
- canonical/netapp solidfire baseboard management controller
- canonical/netapp h410c firmware
- canonical/netapp h410c
- canonical/netapp a700s firmware
- canonical/netapp a700s
- canonical/netapp 8300 firmware
- canonical/netapp 8300
- canonical/netapp 8700 firmware
- canonical/netapp 8700
- canonical/netapp a400 firmware
- canonical/netapp a400