Bug 1846462 (CVE-2019-20812) - CVE-2019-20812 kernel: af_packet: TPACKET_V3: invalid timer timeout on error
Summary: CVE-2019-20812 kernel: af_packet: TPACKET_V3: invalid timer timeout on error
Keywords:
Status: NEW
Alias: CVE-2019-20812
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1823468 1846463 1846467 1846468 1846469 1846470 1846471
Blocks: 1846302
TreeView+ depends on / blocked
 
Reported: 2020-06-11 15:53 UTC by Petr Matousek
Modified: 2020-09-15 20:44 UTC (History)
46 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way the af_packet functionality in the Linux kernel handled the retirement timer setting for TPACKET_v3 when getting settings from the underlying network device errors out. This flaw allows a local user who can open the af_packet domain socket and who can hit the error path, to use this vulnerability to starve the system.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Petr Matousek 2020-06-11 15:53:24 UTC
An issue was discovered in the Linux kernel. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3.

Comment 2 Petr Matousek 2020-06-11 15:53:32 UTC
Statement:

This issue is rated as having Moderate impact because of the preconditions needed to trigger the error code path and privileges required (CAP_NET_RAW).

Comment 3 Petr Matousek 2020-06-11 15:53:35 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 4 Petr Matousek 2020-06-11 15:53:55 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1846463]

Comment 6 Justin M. Forbes 2020-06-12 13:08:52 UTC
This issue was fixed for Fedora with the 5.4.7 stable kernel updates.


Note You need to log in before you can comment on or make changes to this bug.