oss-sec mailing list archives
CVE-2021-20261: kernel: panic in start_motor+0x21 when /dev/fd0 is read by multiple threads.
From: Wade Mealing <wmealing () redhat com>
Date: Thu, 11 Mar 2021 15:59:47 +1000
Gday, A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes greatly. In the default configuration root (or equivalent) permissions are required to attack this flaw. From: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a0c80efe5956ccce9fe7ae5c78542578c07bc20a "In case of multiple threads trying to open("/dev/fdX"), this leads to serious corruptions all over the place, because all of a sudden there is no critical section protection (that'd otherwise be guaranteed by locked fd) whatsoever." It is likely that this memory corruption will at minimum crash the system, at worse corrupt memory and lead to possible privilege escalation. Fixed in: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a0c80efe5956ccce9fe7ae5c78542578c07bc20a Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1932150 To answer the inevitable question that is coming: I'm reporting this because it is my job. ;) Thank you -- Wade Mealing Product Security - Kernel, RHCE Red Hat <https://www.redhat.com> wmealing () redhat com <https://red.ht/sig> TRIED. TESTED. TRUSTED. <https://redhat.com/trusted> secalert () redhat com for urgent response
Current thread:
- CVE-2021-20261: kernel: panic in start_motor+0x21 when /dev/fd0 is read by multiple threads. Wade Mealing (Mar 10)