Bug 1550811 (CVE-2017-18203) - CVE-2017-18203 kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service
Summary: CVE-2017-18203 kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject(...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-18203
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1512096 1551995 1551996 1551997 1551998 1551999
Blocks: 1550812
TreeView+ depends on / blocked
 
Reported: 2018-03-02 04:59 UTC by Sam Fowler
Modified: 2021-06-10 15:00 UTC (History)
27 users (show)

Fixed In Version: kernel 4.14.3
Doc Type: If docs needed, set a value
Doc Text:
The Linux kernel, before version 4.14.3, is vulnerable to a denial of service in drivers/md/dm.c:dm_get_from_kobject() which can be caused by local users leveraging a race condition with __dm_destroy() during creation and removal of DM devices. Only privileged local users (with CAP_SYS_ADMIN capability) can directly perform the ioctl operations for dm device creation and removal and this would typically be outside the direct control of the unprivileged attacker.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:42:08 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:0676 0 None None None 2018-04-10 08:20:20 UTC
Red Hat Product Errata RHSA-2018:1062 0 None None None 2018-04-10 09:44:27 UTC
Red Hat Product Errata RHSA-2018:1854 0 None None None 2018-06-19 04:48:20 UTC
Red Hat Product Errata RHSA-2019:4154 0 None None None 2019-12-10 12:02:18 UTC

Description Sam Fowler 2018-03-02 04:59:23 UTC 
The Linux kernel before version 4.14.3 is vulnerable to a denial of service in drivers/md/dm.c:dm_get_from_kobject() which can be caused by local users leveraging a race condition with __dm_destroy() during creation and removal of DM devices. Only privileged local users (with CAP_SYS_ADMIN capability) can directly perform the ioctl operations for dm device creation and removal and this would typically be outside the direct control of the unprivileged attacker.

References:

https://patchwork.kernel.org/patch/10035971/

https://marc.info/?l=dm-devel&m=150952182422209&w=2

An upstream commit:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b9a41d21dceadf8104812626ef85dc56ee8a60ed
Comment 3 Vladis Dronov 2018-03-06 10:06:27 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1551996]
Comment 5 Vladis Dronov 2018-03-06 10:19:42 UTC 
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, as the code with the flaw is not present in this product.
Comment 11 Justin M. Forbes 2018-03-06 13:42:42 UTC 
This was fixed for Fedora with the 4.14.3 updates.
Comment 27 errata-xmlrpc 2018-04-10 08:20:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:0676 https://access.redhat.com/errata/RHSA-2018:0676
Comment 28 errata-xmlrpc 2018-04-10 09:44:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1062 https://access.redhat.com/errata/RHSA-2018:1062
Comment 29 errata-xmlrpc 2018-06-19 04:48:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1854 https://access.redhat.com/errata/RHSA-2018:1854
Comment 30 errata-xmlrpc 2019-12-10 12:02:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:4154 https://access.redhat.com/errata/RHSA-2019:4154
Note You need to log in before you can comment on or make changes to this bug.