Bug 1848652 (CVE-2020-12114)

Summary:	CVE-2020-12114 kernel: DoS by corrupting mountpoint reference counter
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bhu, blc, bmasney, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, gsuckevi, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mjg59, mlangsdo, nmurray, ptalbert, qzhao, rt-maint, rvrbovsk, steved, walters, williams, wmealing
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel’s implementation of the pivot_root syscall. This flaw allows a local privileged user (root outside or root inside a privileged container) to exploit a race condition to manipulate the reference count of the root filesystem. To be able to abuse this flaw, the process or user calling pivot_root must have advanced permissions. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 20:33:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1850758, 1850759, 1850760, 1850761, 1850762, 1948985, 1848654, 1852649, 1852650, 1852651, 1852652, 1852654, 1947148, 1947149, 1947150, 1947412, 1947413
Bug Blocks:	1848655

Description Dhananjay Arunesh 2020-06-18 17:03:21 UTC

A flaw was found in the Linux kernels implementation of the pivot_root syscall.  A local privileged user (root outside or root inside a privileged container) could exploit a race condition to manipulate the reference count of the root filesystem.

To be able to abuse this flaw, the process or user calling pivot_root must have advanced permissions.  As quoted from the pivot_root(2) man page:

The calling process must have the CAP_SYS_ADMIN capability in the user namespace that owns the caller's mount namespace.

This can allow any user able to execute the pivot_root to cause a denial of service (panic) by corrupting a mountpoint reference counter, possibly allowing for a container escape.

References:
http://seclists.org/oss-sec/2020/q2/86
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.14.178&id=e21c8c03af20932c15d8b1d3bb9cbad9607a6eab
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.4.221&id=83354adbd7a967230bd23a547c5b695567ddba2c
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.19.119&id=f511dc75d22e0c000fc70b54f670c2c17f5fba9a
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.9.221&id=91e997939dda1a866f23ddfb043dcd4a3ff57524

Comment 1 Dhananjay Arunesh 2020-06-18 17:04:06 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1848654]

Comment 2 Justin M. Forbes 2020-06-22 13:30:08 UTC

This was fixed for Fedora in the 5.3 kernel rebases.

Comment 6 Wade Mealing 2020-07-01 02:43:19 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 16 errata-xmlrpc 2021-05-18 13:19:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578

Comment 17 errata-xmlrpc 2021-05-18 14:40:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1739 https://access.redhat.com/errata/RHSA-2021:1739

Comment 18 Product Security DevOps Team 2021-05-18 20:33:55 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-12114

Comment 19 errata-xmlrpc 2021-06-01 16:03:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2190 https://access.redhat.com/errata/RHSA-2021:2190

Comment 20 errata-xmlrpc 2021-06-02 00:46:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2185 https://access.redhat.com/errata/RHSA-2021:2185