Bug 1848652 (CVE-2020-12114) - CVE-2020-12114 kernel: DoS by corrupting mountpoint reference counter
Summary: CVE-2020-12114 kernel: DoS by corrupting mountpoint reference counter
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-12114
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1850758 1850759 1850760 1850761 1850762 1948985 1848654 1852649 1852650 1852651 1852652 1852654 1947148 1947149 1947150 1947412 1947413
Blocks: 1848655
TreeView+ depends on / blocked
 
Reported: 2020-06-18 17:03 UTC by Dhananjay Arunesh
Modified: 2021-06-24 11:50 UTC (History)
48 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s implementation of the pivot_root syscall. This flaw allows a local privileged user (root outside or root inside a privileged container) to exploit a race condition to manipulate the reference count of the root filesystem. To be able to abuse this flaw, the process or user calling pivot_root must have advanced permissions. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-05-18 20:33:55 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:2538 0 None None None 2021-06-23 18:05:52 UTC
Red Hat Product Errata RHBA-2021:2541 0 None None None 2021-06-24 11:50:40 UTC

Description Dhananjay Arunesh 2020-06-18 17:03:21 UTC
A flaw was found in the Linux kernels implementation of the pivot_root syscall.  A local privileged user (root outside or root inside a privileged container) could exploit a race condition to manipulate the reference count of the root filesystem.

To be able to abuse this flaw, the process or user calling pivot_root must have advanced permissions.  As quoted from the pivot_root(2) man page:

The calling process must have the CAP_SYS_ADMIN capability in the user namespace that owns the caller's mount namespace.

This can allow any user able to execute the pivot_root to cause a denial of service (panic) by corrupting a mountpoint reference counter, possibly allowing for a container escape.

References:
http://seclists.org/oss-sec/2020/q2/86
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.14.178&id=e21c8c03af20932c15d8b1d3bb9cbad9607a6eab
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.4.221&id=83354adbd7a967230bd23a547c5b695567ddba2c
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.19.119&id=f511dc75d22e0c000fc70b54f670c2c17f5fba9a
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.9.221&id=91e997939dda1a866f23ddfb043dcd4a3ff57524

Comment 1 Dhananjay Arunesh 2020-06-18 17:04:06 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1848654]

Comment 2 Justin M. Forbes 2020-06-22 13:30:08 UTC
This was fixed for Fedora in the 5.3 kernel rebases.

Comment 6 Wade Mealing 2020-07-01 02:43:19 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 16 errata-xmlrpc 2021-05-18 13:19:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578

Comment 17 errata-xmlrpc 2021-05-18 14:40:20 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1739 https://access.redhat.com/errata/RHSA-2021:1739

Comment 18 Product Security DevOps Team 2021-05-18 20:33:55 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-12114

Comment 19 errata-xmlrpc 2021-06-01 16:03:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2190 https://access.redhat.com/errata/RHSA-2021:2190

Comment 20 errata-xmlrpc 2021-06-02 00:46:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2185 https://access.redhat.com/errata/RHSA-2021:2185


Note You need to log in before you can comment on or make changes to this bug.