Bug 1781204 (CVE-2020-10720)

Summary: CVE-2020-10720 kernel: use-after-free read in napi_gro_frags() in the Linux kernel
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, airlied, bdettelb, bhu, blc, brdeoliv, bskeggs, carnil, dhoward, dvlasenk, esammons, eshatokhin, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jaeshin, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jschorr, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, plougher, pmatouse, qzhao, rt-maint, rvrbovsk, steved, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: kernel 5.2 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s implementation of GRO. This flaw allows an attacker with local access to crash the system.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-07 19:27:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1718393, 1781207, 1832736, 1832737, 1832738    
Bug Blocks: 1781208    

Description Marian Rehak 2019-12-09 14:24:34 UTC
If a network driver provides to napi_gro_frags() an skb with a page fragment of exactly 14 bytes, the call to gro_pull_from_frag0() will 'consume' the fragment by calling skb_frag_unref(skb, 0), and the page might be freed and reused. Reading eth->h_proto at the end of napi_frags_skb() might read mangled data, or crash under specific debugging features.

It is possible that an attacker who is able to trigger this situation may be able to crash the system.  The upstream description describes this flaw as a use-after-free, it appears that this is only able to be triggered as a denial of service but other effects look unlikely although this has not been fully investigated.

External References:


Comment 1 Marian Rehak 2019-12-09 14:30:59 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1781207]

Comment 2 Justin M. Forbes 2019-12-09 17:53:10 UTC
This was fixed for Fedora with the 5.0.21 stable kernel updates.

Comment 3 Evgenii Shatokhin 2019-12-10 08:43:15 UTC
Looks like http://patchwork.lab.bos.redhat.com/patch/271215/ is internal to RedHat.

Are there any external references (e.g. the fix in the mainline or stable kernels)?

Comment 4 Marian Rehak 2019-12-13 10:09:21 UTC
Unfortunately, no external references yet.

Comment 9 Salvatore Bonaccorso 2020-04-30 07:40:07 UTC

Looking at the given description, this matches upstream commit https://git.kernel.org/linus/a4270d6795b0580287453ea55974d948393e66ef in v5.2-rx3 which was backported as well to various stable series 3.16.75, 4.4.181, 4.9.181, 4.14.124, 4.19.48, 5.0.21, 5.1.7.


Comment 10 Evgenii Shatokhin 2020-04-30 09:15:17 UTC
Thank you, Salvatore! Looks like this is it indeed.

And here is, perhaps, the syzbot's report mentioned in the commit message:

Comment 16 Wade Mealing 2020-05-07 08:14:45 UTC

Disabling GSO on the cards using ethtool will prevent this codepath from being taken.

Comment 18 Petr Matousek 2020-05-26 12:33:24 UTC

This issue is rated as having Moderate impact because it appears to be limited to only to a crash.

Comment 20 errata-xmlrpc 2020-07-07 13:18:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2854 https://access.redhat.com/errata/RHSA-2020:2854

Comment 21 Product Security DevOps Team 2020-07-07 19:27:50 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):