Bug 1781204 (CVE-2020-10720) - CVE-2020-10720 kernel: use-after-free read in napi_gro_frags() in the Linux kernel
Summary: CVE-2020-10720 kernel: use-after-free read in napi_gro_frags() in the Linux k...
Alias: CVE-2020-10720
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1718393 1781207 1832736 1832737 1832738
Blocks: 1781208
TreeView+ depends on / blocked
Reported: 2019-12-09 14:24 UTC by Marian Rehak
Modified: 2021-02-16 20:55 UTC (History)
51 users (show)

Fixed In Version: kernel 5.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s implementation of GRO. This flaw allows an attacker with local access to crash the system.
Clone Of:
Last Closed: 2020-07-07 19:27:50 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2854 0 None None None 2020-07-07 13:18:48 UTC

Description Marian Rehak 2019-12-09 14:24:34 UTC
If a network driver provides to napi_gro_frags() an skb with a page fragment of exactly 14 bytes, the call to gro_pull_from_frag0() will 'consume' the fragment by calling skb_frag_unref(skb, 0), and the page might be freed and reused. Reading eth->h_proto at the end of napi_frags_skb() might read mangled data, or crash under specific debugging features.

It is possible that an attacker who is able to trigger this situation may be able to crash the system.  The upstream description describes this flaw as a use-after-free, it appears that this is only able to be triggered as a denial of service but other effects look unlikely although this has not been fully investigated.

External References:


Comment 1 Marian Rehak 2019-12-09 14:30:59 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1781207]

Comment 2 Justin M. Forbes 2019-12-09 17:53:10 UTC
This was fixed for Fedora with the 5.0.21 stable kernel updates.

Comment 3 Evgenii Shatokhin 2019-12-10 08:43:15 UTC
Looks like http://patchwork.lab.bos.redhat.com/patch/271215/ is internal to RedHat.

Are there any external references (e.g. the fix in the mainline or stable kernels)?

Comment 4 Marian Rehak 2019-12-13 10:09:21 UTC
Unfortunately, no external references yet.

Comment 9 Salvatore Bonaccorso 2020-04-30 07:40:07 UTC

Looking at the given description, this matches upstream commit https://git.kernel.org/linus/a4270d6795b0580287453ea55974d948393e66ef in v5.2-rx3 which was backported as well to various stable series 3.16.75, 4.4.181, 4.9.181, 4.14.124, 4.19.48, 5.0.21, 5.1.7.


Comment 10 Evgenii Shatokhin 2020-04-30 09:15:17 UTC
Thank you, Salvatore! Looks like this is it indeed.

And here is, perhaps, the syzbot's report mentioned in the commit message:

Comment 16 Wade Mealing 2020-05-07 08:14:45 UTC

Disabling GSO on the cards using ethtool will prevent this codepath from being taken.

Comment 18 Petr Matousek 2020-05-26 12:33:24 UTC

This issue is rated as having Moderate impact because it appears to be limited to only to a crash.

Comment 20 errata-xmlrpc 2020-07-07 13:18:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2854 https://access.redhat.com/errata/RHSA-2020:2854

Comment 21 Product Security DevOps Team 2020-07-07 19:27:50 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.