Bug 1908827 (CVE-2021-20265) - CVE-2021-20265 kernel: increase slab leak leads to DoS
Summary: CVE-2021-20265 kernel: increase slab leak leads to DoS
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-20265
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1901744 1901797 1935353
Blocks: 1902195 1935011
TreeView+ depends on / blocked
 
Reported: 2020-12-17 17:12 UTC by Dhananjay Arunesh
Modified: 2021-04-20 15:12 UTC (History)
41 users (show)

Fixed In Version: Linux kernel 4.5-rc3
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-03-16 19:19:25 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0856 0 None None None 2021-03-16 13:51:29 UTC
Red Hat Product Errata RHSA-2021:0857 0 None None None 2021-03-16 13:52:28 UTC

Description Dhananjay Arunesh 2020-12-17 17:12:15 UTC 
A flaw was found in the way memory resources were freed in unix_stream_recvmsg function in the Linux kernel when signal was pending. An unprivileged local user could use this flaw to crash the system by exhausting available memory.

Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa0dc04df259ba2df3ce1920e9690c7842f8fa4b
Comment 2 Petr Matousek 2021-03-04 16:47:23 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 6 Petr Matousek 2021-03-08 09:43:50 UTC 
Acknowledgments:

Name: Jay Shin (Red Hat)
Comment 7 errata-xmlrpc 2021-03-16 13:51:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0856 https://access.redhat.com/errata/RHSA-2021:0856
Comment 8 errata-xmlrpc 2021-03-16 13:52:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0857 https://access.redhat.com/errata/RHSA-2021:0857
Comment 9 Product Security DevOps Team 2021-03-16 19:19:25 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20265
Comment 10 errata-xmlrpc 2021-04-20 15:12:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Extended Lifecycle Support

Via RHSA-2021:1288 https://access.redhat.com/errata/RHSA-2021:1288
Note You need to log in before you can comment on or make changes to this bug.