Bug 1781204 (CVE-2020-10720) - CVE-2020-10720 kernel: use-after-free read in napi_gro_frags() in the Linux kernel
Summary: CVE-2020-10720 kernel: use-after-free read in napi_gro_frags() in the Linux k...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-10720
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1718393 1781207 1832736 1832737 1832738
Blocks: 1781208
TreeView+ depends on / blocked
 
Reported: 2019-12-09 14:24 UTC by Marian Rehak
Modified: 2021-02-16 20:55 UTC (History)
51 users (show)

Fixed In Version: kernel 5.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s implementation of GRO. This flaw allows an attacker with local access to crash the system.
Clone Of:
Environment:
Last Closed: 2020-07-07 19:27:50 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2854 0 None None None 2020-07-07 13:18:48 UTC

Description Marian Rehak 2019-12-09 14:24:34 UTC 
If a network driver provides to napi_gro_frags() an skb with a page fragment of exactly 14 bytes, the call to gro_pull_from_frag0() will 'consume' the fragment by calling skb_frag_unref(skb, 0), and the page might be freed and reused. Reading eth->h_proto at the end of napi_frags_skb() might read mangled data, or crash under specific debugging features.

It is possible that an attacker who is able to trigger this situation may be able to crash the system.  The upstream description describes this flaw as a use-after-free, it appears that this is only able to be triggered as a denial of service but other effects look unlikely although this has not been fully investigated.


External References:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4270d6795b0580287453ea55974d948393e66ef
Comment 1 Marian Rehak 2019-12-09 14:30:59 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1781207]
Comment 2 Justin M. Forbes 2019-12-09 17:53:10 UTC 
This was fixed for Fedora with the 5.0.21 stable kernel updates.
Comment 3 Evgenii Shatokhin 2019-12-10 08:43:15 UTC 
Looks like http://patchwork.lab.bos.redhat.com/patch/271215/ is internal to RedHat.

Are there any external references (e.g. the fix in the mainline or stable kernels)?
Comment 4 Marian Rehak 2019-12-13 10:09:21 UTC 
Unfortunately, no external references yet.
Comment 9 Salvatore Bonaccorso 2020-04-30 07:40:07 UTC 
Hi

Looking at the given description, this matches upstream commit https://git.kernel.org/linus/a4270d6795b0580287453ea55974d948393e66ef in v5.2-rx3 which was backported as well to various stable series 3.16.75, 4.4.181, 4.9.181, 4.14.124, 4.19.48, 5.0.21, 5.1.7.

Regards,
Salvatore
Comment 10 Evgenii Shatokhin 2020-04-30 09:15:17 UTC 
Thank you, Salvatore! Looks like this is it indeed.

And here is, perhaps, the syzbot's report mentioned in the commit message:
https://syzkaller.appspot.com/bug?id=7b571739e71a77303e665c793d1f773ce3823226
Comment 16 Wade Mealing 2020-05-07 08:14:45 UTC 
Mitigation:

Disabling GSO on the cards using ethtool will prevent this codepath from being taken.
Comment 18 Petr Matousek 2020-05-26 12:33:24 UTC 
Statement:

This issue is rated as having Moderate impact because it appears to be limited to only to a crash.
Comment 20 errata-xmlrpc 2020-07-07 13:18:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2854 https://access.redhat.com/errata/RHSA-2020:2854
Comment 21 Product Security DevOps Team 2020-07-07 19:27:50 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10720
Note You need to log in before you can comment on or make changes to this bug.