Bug 1848652 (CVE-2020-12114) - CVE-2020-12114 kernel: DoS by corrupting mountpoint reference counter
Summary: CVE-2020-12114 kernel: DoS by corrupting mountpoint reference counter
Keywords:
Status: NEW
Alias: CVE-2020-12114
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1850758 1850759 1850760 1850761 1850762 1852649 1852650 1852651 1852652 1852654 1848654
Blocks: 1848655
TreeView+ depends on / blocked
 
Reported: 2020-06-18 17:03 UTC by Dhananjay Arunesh
Modified: 2020-07-30 15:06 UTC (History)
46 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s implementation of the pivot_root syscall. This flaw allows a local privileged user (root outside or root inside a privileged container) to exploit a race condition to manipulate the reference count of the root filesystem. To be able to abuse this flaw, the process or user calling pivot_root must have advanced permissions. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-06-18 17:03:21 UTC
A flaw was found in the Linux kernels implementation of the pivot_root syscall.  A local privileged user (root outside or root inside a privileged container) could exploit a race condition to manipulate the reference count of the root filesystem.

To be able to abuse this flaw, the process or user calling pivot_root must have advanced permissions.  As quoted from the pivot_root(2) man page:

The calling process must have the CAP_SYS_ADMIN capability in the user namespace that owns the caller's mount namespace.

This can allow any user able to execute the pivot_root to cause a denial of service (panic) by corrupting a mountpoint reference counter, possibly allowing for a container escape.

References:
http://seclists.org/oss-sec/2020/q2/86
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.14.178&id=e21c8c03af20932c15d8b1d3bb9cbad9607a6eab
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.4.221&id=83354adbd7a967230bd23a547c5b695567ddba2c
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.19.119&id=f511dc75d22e0c000fc70b54f670c2c17f5fba9a
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.9.221&id=91e997939dda1a866f23ddfb043dcd4a3ff57524

Comment 1 Dhananjay Arunesh 2020-06-18 17:04:06 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1848654]

Comment 2 Justin M. Forbes 2020-06-22 13:30:08 UTC
This was fixed for Fedora in the 5.3 kernel rebases.

Comment 6 Wade Mealing 2020-07-01 02:43:19 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.


Note You need to log in before you can comment on or make changes to this bug.