Bug 1932150 (CVE-2021-20261) - CVE-2021-20261 kernel: panic on multiple access to floppy device
Summary: CVE-2021-20261 kernel: panic on multiple access to floppy device
Keywords:
Status: NEW
Alias: CVE-2021-20261
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1934398 1934399 1937601
Blocks: 1928876 1932290
TreeView+ depends on / blocked
 
Reported: 2021-02-24 05:07 UTC by Wade Mealing
Modified: 2021-03-12 11:19 UTC (History)
44 users (show)

Fixed In Version: Linux kernel 4.5-rc5
Doc Type: If docs needed, set a value
Doc Text:
A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes greatly. In the default configuration root (or equivalent) permissions are required to attack this flaw.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Wade Mealing 2021-02-24 05:07:54 UTC
A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software.  The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root.  If the permissions on the device have changed the impact changes greatly.  In the default configuration root (or equivalent) permissions are required to attack this flaw.

From: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a0c80efe5956ccce9fe7ae5c78542578c07bc20a

"In case of multiple threads trying to open("/dev/fdX"), this leads to serious corruptions all over the place, because all of a sudden there is no critical section protection (that'd otherwise be guaranteed by lockedfd) whatsoever."

It is likely that this memory corruption will at minimum crash the system, at worse corrupt memory and lead to possible privilege escalation.

Fixed in: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a0c80efe5956ccce9fe7ae5c78542578c07bc20a

Comment 2 Wade Mealing 2021-02-24 05:33:29 UTC
Acknowledgments:

Name: Jay Shin (Red Hat Engineering)

Comment 5 Wade Mealing 2021-03-03 07:03:30 UTC
Mitigation:


As the floppy module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions:

# echo "install floppy /bin/true" >> /etc/modprobe.d/disable-floppy.conf

The system will need to be restarted if the floppy modules are loaded and in use.

Alternatively, disabling the floppy in the BIOS or virtual machine configuration and restarting the system will also ensure that the floppy hardware
will not autoload the kernel floppy module.

If the system requires this module to work correctly, this mitigation may not be suitable.

If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

Comment 7 Wade Mealing 2021-03-11 06:01:25 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1937601]

Comment 8 Justin M. Forbes 2021-03-11 22:44:52 UTC
This was fixed in Fedora with 4.10 kernel updates.

Comment 9 Petr Matousek 2021-03-12 11:17:50 UTC
Statement:

This flaw is rated as having a Moderate impact because the default and supported configuration is not readable by unprivileged users. Moreover, if the attacker is granted access, there are significantly easier attack vectors available.


Note You need to log in before you can comment on or make changes to this bug.