Bug 1915799 (CVE-2021-0342) - CVE-2021-0342 kernel: use after free in tun_get_user of tun.c could lead to local escalation of privilege
Summary: CVE-2021-0342 kernel: use after free in tun_get_user of tun.c could lead to l...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-0342
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1915800 1917563 1917564 1925263
Blocks: 1915801
TreeView+ depends on / blocked
 
Reported: 2021-01-13 12:59 UTC by Marian Rehak
Modified: 2022-04-17 21:05 UTC (History)
47 users (show)

Fixed In Version: kernel 5.8-rc1
Doc Type: If docs needed, set a value
Doc Text:
A flaw use after free in the Linux kernel TUN/TAP device driver functionality was found in the way user create and use tun/tap device. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2021-05-18 20:38:07 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:2538 0 None None None 2021-06-23 18:06:21 UTC
Red Hat Product Errata RHBA-2021:2541 0 None None None 2021-06-24 11:51:40 UTC

Description Marian Rehak 2021-01-13 12:59:59 UTC 
In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required.

Reference:

https://android.googlesource.com/kernel/common/+/96aa1b22bd6bb9fccf62f6261f390ed6f3e7967f
Comment 1 Marian Rehak 2021-01-13 13:01:21 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1915800]
Comment 2 Justin M. Forbes 2021-01-13 17:29:23 UTC 
This was fixed for Fedora with the 5.6.19 stable kernel updates.
Comment 4 Alex 2021-01-18 18:13:27 UTC 
Statement:

This flaw is rated as having Moderate impact because of the need to have elevated privileges and non-standard configuration of the networking device.
Comment 7 Alex 2021-01-18 19:09:56 UTC 
Mitigation:

To mitigate this issue, prevent the module tun from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.
Comment 8 Alex 2021-02-04 17:31:20 UTC 
External References:

https://lore.kernel.org/netdev/20200608230607.3361041-84-sashal@kernel.org/
Comment 11 errata-xmlrpc 2021-05-18 13:20:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1578 https://access.redhat.com/errata/RHSA-2021:1578
Comment 12 errata-xmlrpc 2021-05-18 14:41:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1739 https://access.redhat.com/errata/RHSA-2021:1739
Comment 13 Product Security DevOps Team 2021-05-18 20:38:07 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-0342
Note You need to log in before you can comment on or make changes to this bug.