Bug 1901728 (CVE-2020-27784) - CVE-2020-27784 kernel: deallocated instance in printer_ioctl() printer_ioctl() tries to access lock_printer_io of the printer_dev instance
Summary: CVE-2020-27784 kernel: deallocated instance in printer_ioctl() printer_ioctl(...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-27784
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2122392
Blocks: 1898663 2122622
TreeView+ depends on / blocked
 
Reported: 2020-11-25 21:18 UTC by Dhananjay Arunesh
Modified: 2023-05-31 16:08 UTC (History)
61 users (show)

Fixed In Version: Linux kernel 5.10
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel. This flaw allows a local user with permission to access a printer port and issue an ioctl, creating a use-after-free and corrupting memory or escalating privileges.
Clone Of:
Environment:
Last Closed: 2021-11-08 01:25:00 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-11-25 21:18:09 UTC 
A vulnerability was found in Kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev instance. However, Use-after-free arises because it had been freed by gprinter_free().

Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e8d5f92b8d30bb4ade76494490c3c065e12411b1
Comment 9 Pedro Sampaio 2022-08-29 22:42:42 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2122392]
Comment 10 Justin M. Forbes 2022-08-31 16:19:27 UTC 
This was fixed for Fedora with the 5.8.17 stable kernel updates.
Note You need to log in before you can comment on or make changes to this bug.