Bug 1901726 (CVE-2020-27820)
| Summary: | CVE-2020-27820 kernel: use-after-free in nouveau kernel module | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | acaringi, adscvr, airlied, bhu, blc, bmasney, brdeoliv, bskeggs, dhoward, dvlasenk, fhrbata, hdegoede, hkrzesin, iboverma, itamar, jarodwilson, jeremy, jforbes, jlelli, jonathan, josef, jross, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, kherbst, lgoncalv, linville, masami256, mchehab, mcressma, mlangsdo, nmurray, ptalbert, qzhao, rt-maint, rvrbovsk, security-response-team, steved, walters, williams |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-11 06:16:31 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1901901, 1901902, 1901903, 1901904, 1901905, 1904039, 1911185 | ||
| Bug Blocks: | 1898653, 1940001, 2018914 | ||
|
Description
Dhananjay Arunesh
2020-11-25 21:08:47 UTC
Mitigation: To mitigate this issue, prevent the module nouveau from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically. Statement: This flaw is rated as having a Low impact because the issue can only be triggered by an privileged local user (or user with physical access) as the issue only happens during unbinding the driver or removing the device. External References: https://lore.kernel.org/dri-devel/20201103194912.184413-2-jcline@redhat.com/ https://lore.kernel.org/dri-devel/20201103194912.184413-3-jcline@redhat.com/ https://lore.kernel.org/dri-devel/20201103194912.184413-4-jcline@redhat.com/ Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1904039] Acknowledgments: Name: Jeremy Cline (Red Hat) This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:1975 https://access.redhat.com/errata/RHSA-2022:1975 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:1988 https://access.redhat.com/errata/RHSA-2022:1988 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-27820 |