Bug 1846462 (CVE-2019-20812)

Summary:	CVE-2019-20812 kernel: af_packet: TPACKET_V3: invalid timer timeout on error
Product:	[Other] Security Response	Reporter:	Petr Matousek <pmatouse>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bhu, blc, bmasney, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mjg59, mlangsdo, nmurray, ptalbert, qzhao, rt-maint, rvrbovsk, steved, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the way the af_packet functionality in the Linux kernel handled the retirement timer setting for TPACKET_v3 when getting settings from the underlying network device errors out. This flaw allows a local user who can open the af_packet domain socket and who can hit the error path, to use this vulnerability to starve the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-12-15 11:18:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1823468, 1846463, 1846467, 1846468, 1846469, 1846470, 1846471
Bug Blocks:	1846302

Description Petr Matousek 2020-06-11 15:53:24 UTC

An issue was discovered in the Linux kernel. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3.

Comment 2 Petr Matousek 2020-06-11 15:53:32 UTC

Statement:

This issue is rated as having Moderate impact because of the preconditions needed to trigger the error code path and privileges required (CAP_NET_RAW).

Comment 3 Petr Matousek 2020-06-11 15:53:35 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 4 Petr Matousek 2020-06-11 15:53:55 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1846463]

Comment 6 Justin M. Forbes 2020-06-12 13:08:52 UTC

This issue was fixed for Fedora with the 5.4.7 stable kernel updates.