Bug 1550811 (CVE-2017-18203) - CVE-2017-18203 kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service
Summary: CVE-2017-18203 kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject(...
Status: NEW
Alias: CVE-2017-18203
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20171101,repor...
Keywords: Security
Depends On: 1551997 1551998 1512096 1551995 1551996 1551999
Blocks: 1550812
TreeView+ depends on / blocked
 
Reported: 2018-03-02 04:59 UTC by Sam Fowler
Modified: 2019-02-08 14:58 UTC (History)
27 users (show)

(edit)
The Linux kernel, before version 4.14.3, is vulnerable to a denial of service in drivers/md/dm.c:dm_get_from_kobject() which can be caused by local users leveraging a race condition with __dm_destroy() during creation and removal of DM devices. Only privileged local users (with CAP_SYS_ADMIN capability) can directly perform the ioctl operations for dm device creation and removal and this would typically be outside the direct control of the unprivileged attacker.
Clone Of:
(edit)
Last Closed:


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:0676 None None None 2018-04-10 08:20 UTC
Red Hat Product Errata RHSA-2018:1062 None None None 2018-04-10 09:44 UTC
Red Hat Product Errata RHSA-2018:1854 None None None 2018-06-19 04:48 UTC

Description Sam Fowler 2018-03-02 04:59:23 UTC
The Linux kernel before version 4.14.3 is vulnerable to a denial of service in drivers/md/dm.c:dm_get_from_kobject() which can be caused by local users leveraging a race condition with __dm_destroy() during creation and removal of DM devices. Only privileged local users (with CAP_SYS_ADMIN capability) can directly perform the ioctl operations for dm device creation and removal and this would typically be outside the direct control of the unprivileged attacker.

References:

https://patchwork.kernel.org/patch/10035971/

https://marc.info/?l=dm-devel&m=150952182422209&w=2

An upstream commit:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b9a41d21dceadf8104812626ef85dc56ee8a60ed

Comment 3 Vladis Dronov 2018-03-06 10:06:27 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1551996]

Comment 5 Vladis Dronov 2018-03-06 10:19:42 UTC
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, as the code with the flaw is not present in this product.

Comment 11 Justin M. Forbes 2018-03-06 13:42:42 UTC
This was fixed for Fedora with the 4.14.3 updates.

Comment 27 errata-xmlrpc 2018-04-10 08:20:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:0676 https://access.redhat.com/errata/RHSA-2018:0676

Comment 28 errata-xmlrpc 2018-04-10 09:44:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1062 https://access.redhat.com/errata/RHSA-2018:1062

Comment 29 errata-xmlrpc 2018-06-19 04:48:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1854 https://access.redhat.com/errata/RHSA-2018:1854


Note You need to log in before you can comment on or make changes to this bug.