Bug 1920474 (CVE-2020-0444)

Summary:	CVE-2020-0444 kernel: bad kfree in auditfilter.c may lead to escalation of privilege
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, asavkov, bhu, blc, bmasney, brdeoliv, bskeggs, chwhite, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jpoimboe, jross, jshortt, jstancek, jthierry, jwboyer, kcarcia, kernel-maint, kernel-mgr, kpatch-maint, lgoncalv, linville, masami256, mchehab, mcressma, mlangsdo, nmurray, ptalbert, qzhao, rhandlin, rt-maint, rvrbovsk, steved, walters, williams, wmealing, ycote, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel. A logic error in audit_data_to_entry can lead to a local escalation of privilege without user interaction needed. A local attacker with special user privilege could crash the system leading to information leak. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-03 13:01:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1814448, 1920476, 1921019, 1921020, 1921021, 1921022, 1921024, 1921025, 1921026, 1921027, 1921028, 1921031, 1921032, 1921033, 1921034, 1921035, 1921036, 1921037, 1921038, 1921040, 1921041, 1921042, 1921043, 1921044, 1921045, 1921046, 1921047, 1921659, 1921660, 1921661, 1921662, 1921663, 1922175, 1922176, 1922177, 1922178, 1922179, 1922180, 1922181, 1922182, 1922183, 1922184, 1951566
Bug Blocks:	1920478

Description Marian Rehak 2021-01-26 11:40:15 UTC

In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Reference:

https://android.googlesource.com/kernel/common/+/2ad3e17ebf94b7b7f3f64c050ff168f9915345eb

Comment 1 Marian Rehak 2021-01-26 11:46:50 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1920476]

Comment 2 Justin M. Forbes 2021-01-26 20:07:24 UTC

This issue was fixed for Fedora with the 5.5.8 stable kernel updates.

Comment 9 Wade Mealing 2021-01-28 00:44:48 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 13 errata-xmlrpc 2021-03-02 10:42:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0686 https://access.redhat.com/errata/RHSA-2021:0686

Comment 14 errata-xmlrpc 2021-03-02 10:43:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0689 https://access.redhat.com/errata/RHSA-2021:0689

Comment 15 Product Security DevOps Team 2021-03-03 13:01:51 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-0444

Comment 16 errata-xmlrpc 2021-03-09 09:35:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0763 https://access.redhat.com/errata/RHSA-2021:0763

Comment 17 errata-xmlrpc 2021-03-09 10:22:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0774 https://access.redhat.com/errata/RHSA-2021:0774

Comment 18 errata-xmlrpc 2021-03-09 11:09:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0765 https://access.redhat.com/errata/RHSA-2021:0765