CVE-2020-16119

Published: 13 October 2020

Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.

From the Ubuntu Security Team

Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket reuse, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

patch applied to the ubuntu-kernels was NACKed by upstream.
The subsequent revision submitted upstream still needs rework and has
not been accepted as of 2021-01-13.

Mitigation

Blacklist the dccp ipv[46] autoloading aliases by adding the following
lines to /etc/modprobe.d/blacklist-dccp.conf:
  alias net-pf-2-proto-0-type-6 off
  alias net-pf-2-proto-33-type-6 off
  alias net-pf-10-proto-0-type-6 off
  alias net-pf-10-proto-33-type-6 off

Status

Severity score breakdown

References

• https://www.openwall.com/lists/oss-security/2020/10/13/7
• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=01872cb896c76cedeabe93a08456976ab55ad695
• https://lore.kernel.org/netdev/20201013171849.236025-1-kleber.souza@canonical.com/T/
• https://ubuntu.com/security/notices/USN-4580-1
• https://ubuntu.com/security/notices/USN-4579-1
• https://ubuntu.com/security/notices/USN-4578-1
• https://ubuntu.com/security/notices/USN-4577-1
• https://ubuntu.com/security/notices/USN-4576-1
• https://www.cve.org/CVERecord?id=CVE-2020-16119
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1883840