CVE-2020-16119
published 2021-01-14CVE-2020-16119: Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.42%
34.8th percentile
Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | linux_kernel | >= 3.13 kernel < 3.13.0.182.191 | 3.13.0.182.191 |
| canonical | linux_kernel | >= 3.2 kernel < 3.2.0-149.196 | 3.2.0-149.196 |
| canonical | linux_kernel | >= 4.15 kernel < 4.15.0-121.123 | 4.15.0-121.123 |
| canonical | linux_kernel | >= 4.4 kernel < 4.4.0-193.224 | 4.4.0-193.224 |
| canonical | linux_kernel | >= 5.3 kernel < 5.3.0-68.63 | 5.3.0-68.63 |
| canonical | linux_kernel | >= 5.4 kernel < 5.4.0-51.56 | 5.4.0-51.56 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 5.14.6-1 (bookworm) | linux 5.14.6-1 (bookworm) |
| linux | linux_kernel | >= 0 < 5.10.46-5 | 5.10.46-5 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 4.4.0-193.224 | 4.4.0-193.224 |
| linux | linux_kernel | >= 0 < 4.15.0-121.123 | 4.15.0-121.123 |
| linux | linux_kernel | >= 0 < 5.4.0-51.56 | 5.4.0-51.56 |
| linux | linux_kernel | >= 0 < 4.4.0-193.224 | 4.4.0-193.224 |
| linux | linux_kernel | >= 0 < 4.15.0-121.123 | 4.15.0-121.123 |
| linux | linux_kernel | >= 0 < 5.4.0-51.56 | 5.4.0-51.56 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
vendor_ubuntu6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fgjc-j4q7-m9gg: Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid objec
ghsa_unreviewed·2022-05-24
CVE-2020-16119 [HIGH] CWE-416 GHSA-fgjc-j4q7-m9gg: Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid objec
Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
Kernel
dccp: don't duplicate ccid when cloning dccp sock
kernel_security·2021-09-08·CVSS 7.8
CVE-2017-6074 [HIGH] dccp: don't duplicate ccid when cloning dccp sock
dccp: don't duplicate ccid when cloning dccp sock
Commit 2677d2067731 ("dccp: don't free ccid2_hc_tx_sock ...") fixed
a UAF but reintroduced CVE-2017-6074.
When the sock is cloned, two dccps_hc_tx_ccid will reference to the
same ccid. So one can free the ccid object twice from two socks after
cloning.
This issue was found by "Hadar Manor" as well and assigned with
CVE-2020-16119, which was fixed in Ubuntu's kernel. So here I port
the patch from Ubuntu to fix it.
The patch prevents cloned socks from referencing the same ccid.
Fixes: 2677d2067731410 ("dccp: don't free ccid2_hc_tx_sock ...")
Signed-off-by: Zhenpeng Lin
Signed-off-by: David S. Miller
OSV
CVE-2020-16119: Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid objec
osv·2021-01-14·CVSS 7.8
CVE-2020-16119 [HIGH] CVE-2020-16119: Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid objec
Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
osv·2020-10-14·CVSS 5.5
CVE-2020-16119 [MEDIUM] linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
leading to an out-of-bounds read vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2020-14314)
David Alan Gilbert discovered tha
OSV
Kernel Live Patch Security Notice
osv·2020-10-14·CVSS 4.4
CVE-2020-0067 [MEDIUM] Kernel Live Patch Security Notice
Kernel Live Patch Security Notice
It was discovered that the F2FS file system implementation in the Linux
kernel did not properly perform bounds checking on xattrs in some
situations. A local attacker could possibly use this to expose sensitive
information (kernel memory). (CVE-2020-0067)
It was discovered that the Serial CAN interface driver in the Linux kernel
did not properly initialize data. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-11494)
Mauricio Faria de Oliveira discovered that the aufs implementation in the
Linux kernel improperly managed inode reference counts in the
vfsub_dentry_open() method. A local attacker could use this vulnerability
to cause a denial of service. (CVE-2020-11935)
Piotr Krysiuk discovered that race conditi
OSV
linux-hwe, linux-gke-5.0, linux-gke-5.3, linux-oem-osp1, linux-raspi2-5.3 vulnerabilities
osv·2020-10-14·CVSS 7.8
CVE-2020-16119 [HIGH] linux-hwe, linux-gke-5.0, linux-gke-5.3, linux-oem-osp1, linux-raspi2-5.3 vulnerabilities
linux-hwe, linux-gke-5.0, linux-gke-5.3, linux-oem-osp1, linux-raspi2-5.3 vulnerabilities
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Giuseppe Scrivano discovered that the overlay file system in the Linux
kernel did not properly perform permission checks in some situations. A
local attacker could possibly use this to bypass intended restrictions and
gain read access to restricted files. (CVE-2020-16120)
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2020-10-14·CVSS 5.5
CVE-2020-16119 [MEDIUM] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Wen Xu discovered that the XFS file system in the Linux kernel did not
properly validate inode metadata in some situations. An attacker could use
this to construct a malicious XFS image that, when mounted, could cause a
denial of service (system crash). (CVE-2018-10322)
It was discovered that the btrfs file s
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
osv·2020-10-14·CVSS 5.5
CVE-2020-16119 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Wen Xu discovered that the XFS file system in the Linux kernel did not
properly validate inode metadata in some situations. An attacker could use
this to construct a malicious XFS image that, when mounted, could cause a
denial of service (system crash). (CVE-2018-10322)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
le
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-10-14·CVSS 6.3
CVE-2020-16119 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Giuseppe Scrivano discovered that the overlay file system in the Linux
kernel did not properly perform permission checks in some situations. A
local attacker could possibly use this to bypass intended restrictions and
gain read access to restricted files. (CVE-2020-16120)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an u
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-10-14·CVSS 5.5
CVE-2020-14314 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
leading to an out-of-bounds read vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2020-14314)
David Alan Gilbert discovered that the XFS file system implementation in
the Linux kernel did not properly perform metadata
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-10-14·CVSS 5.5
CVE-2020-16119 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Wen Xu discovered that the XFS file system in the Linux kernel did not
properly validate inode metadata in some situations. An attacker could use
this to construct a malicious XFS image that, when mounted, could cause a
denial of service (system crash). (CVE-2018-10322)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken inde
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-10-14·CVSS 5.5
CVE-2020-26088 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Wen Xu discovered that the XFS file system in the Linux kernel did not
properly validate inode metadata in some situations. An attacker could use
this to construct a malicious XFS image that, when mounted, could cause a
denial of service (system crash). (CVE-2018-10322)
It was discovered that the btrfs file system in the Linux kernel contained
a use-after-free vulnerability when merging free space. An atta
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2020-10-14
CVE-2020-16119 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: The system could be made to crash or possibly run programs as an
administrator.
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, l
Ubuntu
Kernel Live Patch Security Notice
vendor_ubuntu·2020-10-14·CVSS 4.4
CVE-2020-11935 [MEDIUM] Kernel Live Patch Security Notice
Title: Kernel Live Patch Security Notice
Summary: Several security issues were fixed in the kernel.
It was discovered that the F2FS file system implementation in the Linux
kernel did not properly perform bounds checking on xattrs in some
situations. A local attacker could possibly use this to expose sensitive
information (kernel memory). (CVE-2020-0067)
It was discovered that the Serial CAN interface driver in the Linux kernel
did not properly initialize data. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-11494)
Mauricio Faria de Oliveira discovered that the aufs implementation in the
Linux kernel improperly managed inode reference counts in the
vfsub_dentry_open() method. A local attacker could use this vulnerability
to cause a denial of se
Red Hat
kernel: DCCP CCID structure use-after-free may lead to DoS or code execution
vendor_redhat·2020-10-13·CVSS 6.3
CVE-2020-16119 [MEDIUM] CWE-416 kernel: DCCP CCID structure use-after-free may lead to DoS or code execution
kernel: DCCP CCID structure use-after-free may lead to DoS or code execution
Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
A flaw was found in the Linux kernel. When reusing a socket with an attached dccps_hc_tx_ccid as a listener, the socket will be used after being released leading to denial of service (DoS) or a potential code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Mitigation: Red Hat has previously automatically blacklisted the DCCP module
Debian
CVE-2020-16119: linux - Use-after-free vulnerability in the Linux kernel exploitable by a local attacker...
vendor_debian·2020·CVSS 6.3
CVE-2020-16119 [MEDIUM] CVE-2020-16119: linux - Use-after-free vulnerability in the Linux kernel exploitable by a local attacker...
Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
Scope: local
bookworm: resolved (fixed in 5.14.6-1)
bullseye: resolved (fixed in 5.10.46-5)
forky: resolved (fixed in 5.14.6-1)
sid: resolved (fixed in 5.14.6-1)
trixie: resolved (fixed in 5.14.6-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-16119 kernel: DCCP CCID structure use-after-free may lead to DoS or code execution [fedora-all]
bugzilla·2020-10-14·CVSS 6.3
CVE-2020-16119 [MEDIUM] CVE-2020-16119 kernel: DCCP CCID structure use-after-free may lead to DoS or code execution [fedora-all]
CVE-2020-16119 kernel: DCCP CCID structure use-after-free may lead to DoS or code execution [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2020-16119 kernel: DCCP CCID structure use-after-free may lead to DoS or code execution
bugzilla·2020-10-08·CVSS 6.3
CVE-2020-16119 [MEDIUM] CVE-2020-16119 kernel: DCCP CCID structure use-after-free may lead to DoS or code execution
CVE-2020-16119 kernel: DCCP CCID structure use-after-free may lead to DoS or code execution
A flaw was found in the Linux kernels implementation of the DCCP protocol. When reusing a socket with an attached dccps_hc_tx_ccid as a listener, it will be used after being released, leading to DoS and potentially code execution. When a DCCP socket is cloned, the pointers to dccps_hc_rx_ccid and dccps_hc_tx_ccid are copied. When CCID features are activated on the child socket, the CCID objects are freed, leaving the parent socket with dangling pointers.
Discussion:
Mitigation:
Red Hat has previously automatically blacklisted the DCCP module in Red Hat Enterprise Linux 7.5 and later in /etc/modprobe.d/dccp-blacklist.conf.
If this file does not exist with the above contents, the module can be pr
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=01872cb896c76cedeabe93a08456976ab55ad695https://launchpad.net/bugs/1883840https://lists.debian.org/debian-lts-announce/2021/10/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2021/12/msg00012.htmlhttps://lore.kernel.org/netdev/20201013171849.236025-1-kleber.souza%40canonical.com/T/https://security.netapp.com/advisory/ntap-20210304-0006/https://ubuntu.com/USN-4576-1https://ubuntu.com/USN-4577-1https://ubuntu.com/USN-4578-1https://ubuntu.com/USN-4579-1https://ubuntu.com/USN-4580-1https://www.debian.org/security/2021/dsa-4978https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=01872cb896c76cedeabe93a08456976ab55ad695https://launchpad.net/bugs/1883840https://lists.debian.org/debian-lts-announce/2021/10/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2021/12/msg00012.htmlhttps://lore.kernel.org/netdev/20201013171849.236025-1-kleber.souza%40canonical.com/T/https://security.netapp.com/advisory/ntap-20210304-0006/https://ubuntu.com/USN-4576-1https://ubuntu.com/USN-4577-1https://ubuntu.com/USN-4578-1https://ubuntu.com/USN-4579-1https://ubuntu.com/USN-4580-1https://www.debian.org/security/2021/dsa-4978
2021-01-14
Published