Bug 1919889 (CVE-2020-0431)

Summary:	CVE-2020-0431 kernel: possible out of bounds write in kbd_keycode of keyboard.c
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bhu, blc, bmasney, brdeoliv, bskeggs, chwhite, dhoward, dramseur, dvlasenk, fhrbata, hdegoede, hkrzesin, itamar, jarodwilson, jeremy, jforbes, jglisse, jhunter, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, kmitts, lgoncalv, linville, masami256, mchehab, mgala, mjudeiki, mlangsdo, nmurray, ptalbert, qzhao, rvrbovsk, steved, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw out of bounds write in the Linux kernel human interface devices subsystem was found in the way user calls find key code by index. A local user could use this flaw to crash the system or escalate privileges on the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 20:38:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1885560, 1919890, 1921124, 1921125, 1925128
Bug Blocks:	1919793

Description Dhananjay Arunesh 2021-01-25 11:26:48 UTC

In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a
missing bounds check. This could lead to local escalation of privilege with no
additional execution privileges needed. User interaction is not needed for
exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-144161459

References:
https://android.googlesource.com/kernel/common/+/cb0a3edf8d00
https://source.android.com/security/bulletin/pixel/2020-09-01

Comment 1 Dhananjay Arunesh 2021-01-25 11:29:12 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1919890]

Comment 2 Justin M. Forbes 2021-01-25 17:26:52 UTC

This was fixed for Fedora with the 5.5 kernel rebases.

Comment 3 Alex 2021-01-27 14:43:42 UTC

Statement:

This flaw is rated as having a Moderate impact because in the default configuration, the issue can only be triggered by a privileged local user.

Comment 5 Alex 2021-01-27 14:44:52 UTC

External References:

https://patchwork.kernel.org/project/linux-input/patch/20191207210518.GA181006@dtor-ws/

Comment 6 Alex 2021-01-27 14:48:35 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 10 errata-xmlrpc 2021-05-18 13:21:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578

Comment 11 errata-xmlrpc 2021-05-18 14:41:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1739 https://access.redhat.com/errata/RHSA-2021:1739

Comment 12 Product Security DevOps Team 2021-05-18 20:38:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-0431