Bug 1901726 (CVE-2020-27820) - CVE-2020-27820 kernel: use-after-free in nouveau kernel module
Summary: CVE-2020-27820 kernel: use-after-free in nouveau kernel module
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-27820
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1901901 1901902 1901903 1901904 1901905 1904039 1911185
Blocks: 1898653 1940001 2018914
TreeView+ depends on / blocked
 
Reported: 2020-11-25 21:08 UTC by Dhananjay Arunesh
Modified: 2022-06-16 11:22 UTC (History)
44 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver).
Clone Of:
Environment:
Last Closed: 2022-05-11 06:16:31 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:2229 0 None None None 2022-05-12 11:26:08 UTC
Red Hat Product Errata RHBA-2022:4630 0 None None None 2022-05-18 11:45:54 UTC
Red Hat Product Errata RHBA-2022:4693 0 None None None 2022-05-19 05:10:20 UTC
Red Hat Product Errata RHBA-2022:4969 0 None None None 2022-06-08 18:39:23 UTC
Red Hat Product Errata RHBA-2022:5088 0 None None None 2022-06-16 11:22:42 UTC
Red Hat Product Errata RHSA-2022:1975 0 None None None 2022-05-10 14:38:37 UTC
Red Hat Product Errata RHSA-2022:1988 0 None None None 2022-05-10 14:44:27 UTC

Description Dhananjay Arunesh 2020-11-25 21:08:47 UTC 
A vulnerability was found in kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver).
Comment 4 Alex 2020-11-26 11:43:25 UTC 
Mitigation:

To mitigate this issue, prevent the module nouveau from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.
Comment 6 Petr Matousek 2020-11-26 15:44:58 UTC 
Statement:

This flaw is rated as having a Low impact because the issue can only be triggered by an privileged local user (or user with physical access) as the issue only happens during unbinding the driver or removing the device.
Comment 8 Petr Matousek 2020-12-03 12:08:31 UTC 
External References:

https://lore.kernel.org/dri-devel/20201103194912.184413-2-jcline@redhat.com/
https://lore.kernel.org/dri-devel/20201103194912.184413-3-jcline@redhat.com/
https://lore.kernel.org/dri-devel/20201103194912.184413-4-jcline@redhat.com/
Comment 9 Petr Matousek 2020-12-03 12:10:02 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1904039]
Comment 11 Dhananjay Arunesh 2021-01-12 10:34:37 UTC 
Acknowledgments:

Name: Jeremy Cline (Red Hat)
Comment 28 errata-xmlrpc 2022-05-10 14:38:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1975 https://access.redhat.com/errata/RHSA-2022:1975
Comment 29 errata-xmlrpc 2022-05-10 14:44:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1988 https://access.redhat.com/errata/RHSA-2022:1988
Comment 30 Product Security DevOps Team 2022-05-11 06:16:27 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-27820
Note You need to log in before you can comment on or make changes to this bug.