Bug 1901726 (CVE-2020-27820) - CVE-2020-27820 kernel: use-after-free in nouveau kernel module
Summary: CVE-2020-27820 kernel: use-after-free in nouveau kernel module
Keywords:
Status: NEW
Alias: CVE-2020-27820
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1901903 1901904 1911185 1901901 1901902 1901905 1904039
Blocks: 1898653 1940001 2018914
TreeView+ depends on / blocked
 
Reported: 2020-11-25 21:08 UTC by Dhananjay Arunesh
Modified: 2021-11-01 09:02 UTC (History)
45 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver).
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-11-25 21:08:47 UTC
A vulnerability was found in kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver).

Comment 4 Alex 2020-11-26 11:43:25 UTC
Mitigation:

To mitigate this issue, prevent the module nouveau from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.

Comment 6 Petr Matousek 2020-11-26 15:44:58 UTC
Statement:

This flaw is rated as having a Low impact because the issue can only be triggered by an privileged local user (or user with physical access) as the issue only happens during unbinding the driver or removing the device.

Comment 9 Petr Matousek 2020-12-03 12:10:02 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1904039]

Comment 11 Dhananjay Arunesh 2021-01-12 10:34:37 UTC
Acknowledgments:

Name: Jeremy Cline (Red Hat)


Note You need to log in before you can comment on or make changes to this bug.