Bug 1550811 (CVE-2017-18203)

Summary:	CVE-2017-18203 kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agk, aquini, bhu, blc, dhoward, fhrbata, hkrzesin, hwkernel-mgr, iboverma, jforbes, jkacur, jross, kernel-mgr, lgoncalv, matt, mcressma, mlangsdo, msnitzer, nmurray, plougher, rt-maint, rvrbovsk, skozina, slawomir, vdronov, williams, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 4.14.3	Doc Type:	If docs needed, set a value
Doc Text:	The Linux kernel, before version 4.14.3, is vulnerable to a denial of service in drivers/md/dm.c:dm_get_from_kobject() which can be caused by local users leveraging a race condition with __dm_destroy() during creation and removal of DM devices. Only privileged local users (with CAP_SYS_ADMIN capability) can directly perform the ioctl operations for dm device creation and removal and this would typically be outside the direct control of the unprivileged attacker.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:42:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1512096, 1551995, 1551996, 1551997, 1551998, 1551999
Bug Blocks:	1550812

Description Sam Fowler 2018-03-02 04:59:23 UTC

The Linux kernel before version 4.14.3 is vulnerable to a denial of service in drivers/md/dm.c:dm_get_from_kobject() which can be caused by local users leveraging a race condition with __dm_destroy() during creation and removal of DM devices. Only privileged local users (with CAP_SYS_ADMIN capability) can directly perform the ioctl operations for dm device creation and removal and this would typically be outside the direct control of the unprivileged attacker.

References:

https://patchwork.kernel.org/patch/10035971/

https://marc.info/?l=dm-devel&m=150952182422209&w=2

An upstream commit:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b9a41d21dceadf8104812626ef85dc56ee8a60ed

Comment 3 Vladis Dronov 2018-03-06 10:06:27 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1551996]

Comment 5 Vladis Dronov 2018-03-06 10:19:42 UTC

Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, as the code with the flaw is not present in this product.

Comment 11 Justin M. Forbes 2018-03-06 13:42:42 UTC

This was fixed for Fedora with the 4.14.3 updates.

Comment 27 errata-xmlrpc 2018-04-10 08:20:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:0676 https://access.redhat.com/errata/RHSA-2018:0676

Comment 28 errata-xmlrpc 2018-04-10 09:44:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1062 https://access.redhat.com/errata/RHSA-2018:1062

Comment 29 errata-xmlrpc 2018-06-19 04:48:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1854 https://access.redhat.com/errata/RHSA-2018:1854

Comment 30 errata-xmlrpc 2019-12-10 12:02:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:4154 https://access.redhat.com/errata/RHSA-2019:4154