CVE-2020-29661

kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.

Se detectó un problema de bloqueo en el subsistema tty del kernel de Linux versiones hasta 5.9.13. El archivo drivers/tty/tty_jobctrl.c, permite un ataque de uso de la memoria previamente liberada contra TIOCSPGRP, también se conoce como CID-54ffccbf053b

A locking vulnerability was found in the tty subsystem of the Linux kernel in drivers/tty/tty_jobctrl.c. This flaw allows a local attacker to possibly corrupt memory or escalate privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Linux suffers from broken locking in TIOCSPGRP that can lead to a corrupted refcount.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-12-09 CVE Reserved
2020-12-09 CVE Published
2023-03-08 EPSS Updated
2024-08-04 CVE Updated
2024-08-05 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-416: Use After Free
CWE-667: Improper Locking

CAPEC

References (14)

URL	Tag	Source
http://packetstormsecurity.com/files/160681/Linux-TIOCSPGRP-Broken-Locking.html	Third Party Advisory
http://packetstormsecurity.com/files/164950/Kernel-Live-Patch-Security-Notice-LSN-0082-1.html	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html	Mailing List
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html	Mailing List
https://security.netapp.com/advisory/ntap-20210122-0001	Third Party Advisory

URL	Date	SRC
https://github.com/wojkos9/arm-CVE-2020-29661	2024-08-05

URL	Date	SRC
http://www.openwall.com/lists/oss-security/2020/12/10/1	2023-11-07
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=54ffccbf053b5b6ca4f6e45094b942fab92a25fc	2023-11-07
https://www.oracle.com/security-alerts/cpuoct2021.html	2023-11-07

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BOB25SU6XUL4TNP7KB63WNZSYTIYFDPP	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZ7OAKAEFAXQRGBZK4LYUWINCD3D2XCL	2023-11-07
https://www.debian.org/security/2021/dsa-4843	2023-11-07
https://access.redhat.com/security/cve/CVE-2020-29661	2021-06-01
https://bugzilla.redhat.com/show_bug.cgi?id=1906525	2021-06-01

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Netapp Search vendor "Netapp"	Solidfire Baseboard Management Controller Firmware Search vendor "Netapp" for product "Solidfire Baseboard Management Controller Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	Solidfire Baseboard Management Controller Search vendor "Netapp" for product "Solidfire Baseboard Management Controller"	-	-	Safe
Netapp Search vendor "Netapp"	H410c Firmware Search vendor "Netapp" for product "H410c Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	H410c Search vendor "Netapp" for product "H410c"	-	-	Safe
Netapp Search vendor "Netapp"	A700s Firmware Search vendor "Netapp" for product "A700s Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	A700s Search vendor "Netapp" for product "A700s"	-	-	Safe
Netapp Search vendor "Netapp"	8300 Firmware Search vendor "Netapp" for product "8300 Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	8300 Search vendor "Netapp" for product "8300"	-	-	Safe
Netapp Search vendor "Netapp"	8700 Firmware Search vendor "Netapp" for product "8700 Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	8700 Search vendor "Netapp" for product "8700"	-	-	Safe
Netapp Search vendor "Netapp"	A400 Firmware Search vendor "Netapp" for product "A400 Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	A400 Search vendor "Netapp" for product "A400"	-	-	Safe
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 2.6.26 < 4.4.248 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.26 < 4.4.248"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.5 < 4.9.248 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.5 < 4.9.248"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.10 < 4.14.212 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.10 < 4.14.212"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.15 < 4.19.163 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.15 < 4.19.163"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.20 < 5.4.83 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.20 < 5.4.83"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.5 < 5.9.14 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.5 < 5.9.14"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				32 Search vendor "Fedoraproject" for product "Fedora" and version "32"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				33 Search vendor "Fedoraproject" for product "Fedora" and version "33"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Netapp Search vendor "Netapp"		Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager"				-		vmware_vsphere		Affected
Broadcom Search vendor "Broadcom"		Fabric Operating System Search vendor "Broadcom" for product "Fabric Operating System"				-		-		Affected
Oracle Search vendor "Oracle"		Tekelec Platform Distribution Search vendor "Oracle" for product "Tekelec Platform Distribution"				>= 7.4.0 <= 7.7.1 Search vendor "Oracle" for product "Tekelec Platform Distribution" and version " >= 7.4.0 <= 7.7.1"		-		Affected