Bug 1839634 (CVE-2020-10751) - CVE-2020-10751 kernel: SELinux netlink permission check bypass
Summary: CVE-2020-10751 kernel: SELinux netlink permission check bypass
Keywords:
Status: NEW
Alias: CVE-2020-10751
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1839643 1839644 1839645 1839650 1844353 1845039
Blocks: 1830297
TreeView+ depends on / blocked
 
Reported: 2020-05-25 06:43 UTC by Wade Mealing
Modified: 2020-06-25 12:38 UTC (History)
49 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel’s SELinux LSM hook implementation, where it anticipated the skb would only contain a single Netlink message. The hook incorrectly validated the first Netlink message in the skb only, to allow or deny the rest of the messages within the skb with the granted permissions and without further processing. At this time, there is no known ability for an attacker to abuse this flaw.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Wade Mealing 2020-05-25 06:43:06 UTC
A flaw was found in the Linux kernel SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message.  The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.

At this time, there is no known ability for an attacker to use this to abuse this flaw as capabilities are required to process any 'modify' operation.

Comment 11 Wade Mealing 2020-06-05 07:55:20 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1844353]

Comment 13 Petr Matousek 2020-06-08 10:50:29 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 15 Justin M. Forbes 2020-06-08 12:35:04 UTC
This was fixed for Fedora with the 5.6.11 stable kernel updates.


Note You need to log in before you can comment on or make changes to this bug.