Bug 1915799 (CVE-2021-0342)

Summary: CVE-2021-0342 kernel: use after free in tun_get_user of tun.c could lead to local escalation of privilege
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, adscvr, airlied, alciregi, bhu, blc, bmasney, brdeoliv, bskeggs, chwhite, dhoward, dramseur, dvlasenk, fhrbata, hdegoede, hkrzesin, itamar, jarodwilson, jeremy, jforbes, jglisse, jhunter, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, kmitts, lgoncalv, linville, masami256, mchehab, mgala, mjudeiki, mlangsdo, nmurray, ptalbert, qzhao, rvrbovsk, sburke, steved, walters, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: kernel 5.8-rc1 Doc Type: If docs needed, set a value
Doc Text:
A flaw use after free in the Linux kernel TUN/TAP device driver functionality was found in the way user create and use tun/tap device. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-05-18 20:38:07 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1915800, 1917563, 1917564, 1925263    
Bug Blocks: 1915801    

Description Marian Rehak 2021-01-13 12:59:59 UTC
In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required.



Comment 1 Marian Rehak 2021-01-13 13:01:21 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1915800]

Comment 2 Justin M. Forbes 2021-01-13 17:29:23 UTC
This was fixed for Fedora with the 5.6.19 stable kernel updates.

Comment 4 Alex 2021-01-18 18:13:27 UTC

This flaw is rated as having Moderate impact because of the need to have elevated privileges and non-standard configuration of the networking device.

Comment 7 Alex 2021-01-18 19:09:56 UTC

To mitigate this issue, prevent the module tun from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.

Comment 11 errata-xmlrpc 2021-05-18 13:20:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578

Comment 12 errata-xmlrpc 2021-05-18 14:41:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1739 https://access.redhat.com/errata/RHSA-2021:1739

Comment 13 Product Security DevOps Team 2021-05-18 20:38:07 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):