Bug 1182109 (CVE-2021-20200)

Summary: VUL-0: CVE-2021-20200: kernel-source: close race between munmap() and expand_upwards()/downwards()
Product: [Novell Products] SUSE Security Incidents Reporter: Alexandros Toptsoglou <atoptsoglou>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED DUPLICATE QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P5 - None CC: smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/277651/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Alexandros Toptsoglou 2021-02-11 09:23:08 UTC 
CVE-2021-20200

A use-after-free flaw may be seen due to a race problem while in detach_vmas_to_be_unmapped() in mm/mmap.c in VMA access while munmap(). This flaw could allow a local attacker with a user privilege to crash the system, because VMA with VM_GROWSDOWN or VM_GROWSUP flag set may change their size under mmap_read_lock(). This vulnerability could even lead to a kernel information leak problem.

References:
https://bugs.chromium.org/p/project-zero/issues/detail?id=2056
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=246c320a8cfe0b11d81a4af38fa9985ef0cc9a4c
https://redhat.service-now.com/surl.do?n=INC1430424

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1908249
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20200
https://bugs.chromium.org/p/project-zero/issues/detail?id=2056
http://seclists.org/oss-sec/2021/q1/136
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=246c320a8cfe0b11d81a4af38fa9985ef0cc9a4c
Comment 1 Alexandros Toptsoglou 2021-02-11 09:24:37 UTC 
A wrongly/duplicate CVE assignment probably it will be rejected. Closing

*** This bug has been marked as a duplicate of bug 1179432 ***