Bug 1882591 (CVE-2020-25285)

Summary:	CVE-2020-25285 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bhu, blc, bmasney, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mjg59, mlangsdo, nmurray, ptalbert, qzhao, rt-maint, rvrbovsk, steved, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on internal variables leading to a system crash or memory corruption.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 20:36:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1882592, 1886241, 1886242
Bug Blocks:	1886218

Description Dhananjay Arunesh 2020-09-25 04:39:04 UTC

A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact

References:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17743798d81238ab13050e8e2833699b54e15467
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.8

Comment 1 Dhananjay Arunesh 2020-09-25 04:39:57 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1882592]

Comment 3 Justin M. Forbes 2020-09-25 12:31:56 UTC

This was fixed for Fedora with the 5.8.8 stable kernel updates.

Comment 5 Wade Mealing 2020-10-08 01:41:37 UTC

This flaw is rated as a moderate, access to write to /proc/sys/vm/nr_hugepages is restricted to root and not available to regular users.

Comment 11 Petr Matousek 2020-10-13 15:57:56 UTC

Statement:

This flaw is rated as having Moderate impact as access to write to /proc/sys/vm/nr_hugepages is restricted to root and not available to regular users.

Comment 12 Petr Matousek 2020-10-13 15:57:58 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 13 errata-xmlrpc 2021-05-18 13:20:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578

Comment 14 errata-xmlrpc 2021-05-18 14:40:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1739 https://access.redhat.com/errata/RHSA-2021:1739

Comment 15 Product Security DevOps Team 2021-05-18 20:36:20 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-25285