Bug 1915799 (CVE-2021-0342)

Summary:	CVE-2021-0342 kernel: use after free in tun_get_user of tun.c could lead to local escalation of privilege
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bhu, blc, bmasney, brdeoliv, bskeggs, chwhite, dhoward, dramseur, dvlasenk, fhrbata, hdegoede, hkrzesin, itamar, jarodwilson, jeremy, jforbes, jglisse, jhunter, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, kmitts, lgoncalv, linville, masami256, mchehab, mgala, mjudeiki, mlangsdo, nmurray, ptalbert, qzhao, rvrbovsk, sburke, steved, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 5.8-rc1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw use after free in the Linux kernel TUN/TAP device driver functionality was found in the way user create and use tun/tap device. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 20:38:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1915800, 1917563, 1917564, 1925263
Bug Blocks:	1915801

Description Marian Rehak 2021-01-13 12:59:59 UTC

In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required.

Reference:

https://android.googlesource.com/kernel/common/+/96aa1b22bd6bb9fccf62f6261f390ed6f3e7967f

Comment 1 Marian Rehak 2021-01-13 13:01:21 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1915800]

Comment 2 Justin M. Forbes 2021-01-13 17:29:23 UTC

This was fixed for Fedora with the 5.6.19 stable kernel updates.

Comment 4 Alex 2021-01-18 18:13:27 UTC

Statement:

This flaw is rated as having Moderate impact because of the need to have elevated privileges and non-standard configuration of the networking device.

Comment 7 Alex 2021-01-18 19:09:56 UTC

Mitigation:

To mitigate this issue, prevent the module tun from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.

Comment 8 Alex 2021-02-04 17:31:20 UTC

External References:

https://lore.kernel.org/netdev/20200608230607.3361041-84-sashal@kernel.org/

Comment 11 errata-xmlrpc 2021-05-18 13:20:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578

Comment 12 errata-xmlrpc 2021-05-18 14:41:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1739 https://access.redhat.com/errata/RHSA-2021:1739

Comment 13 Product Security DevOps Team 2021-05-18 20:38:07 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-0342