Bug 1932150 (CVE-2021-20261)
Summary: | CVE-2021-20261 kernel: panic on multiple access to floppy device | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Wade Mealing <wmealing> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | acaringi, adscvr, airlied, alciregi, bhu, blc, bmasney, brdeoliv, bskeggs, chwhite, dhoward, dvlasenk, fhrbata, fpacheco, hdegoede, hkrzesin, jaeshin, jarodwilson, jeremy, jforbes, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mlangsdo, nmurray, pmatouse, ptalbert, qzhao, rvrbovsk, security-response-team, steved, walters, williams |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Linux kernel 4.5-rc5 | Doc Type: | If docs needed, set a value |
Doc Text: |
A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes greatly. In the default configuration root (or equivalent) permissions are required to attack this flaw.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-11-08 01:37:38 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1934398, 1934399, 1937601 | ||
Bug Blocks: | 1928876, 1932290 |
Description
Wade Mealing
2021-02-24 05:07:54 UTC
Acknowledgments: Name: Jay Shin (Red Hat Engineering) Mitigation: As the floppy module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions: # echo "install floppy /bin/true" >> /etc/modprobe.d/disable-floppy.conf The system will need to be restarted if the floppy modules are loaded and in use. Alternatively, disabling the floppy in the BIOS or virtual machine configuration and restarting the system will also ensure that the floppy hardware will not autoload the kernel floppy module. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1937601] This was fixed in Fedora with 4.10 kernel updates. Statement: This flaw is rated as having a Moderate impact because the default and supported configuration is not readable by unprivileged users. Moreover, if the attacker is granted access, there are significantly easier attack vectors available. |