Linux Kernel PV Block Backend Pointer Reuse (CVE-2020-29569)
Summary
CVE-2020-29569: An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. Affects linux-lts versions < 5.10.4-r0. Fixed in 5.10.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing system resources and facilitating communication between hardware and software components. The PV block backend is a component of the Linux kernel that handles block devices in a paravirtualized environment. It allows virtual machines running on the Xen hypervisor to access block storage devices. However, a vulnerability has been discovered in the Linux kernel PV block backend, which could lead to privilege escalation, information leaks, and system crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2020-29569, exists in the Linux kernel through version 5.10.1 when used with Xen through version 4.14.x. The issue arises from the PV block backend's incorrect handling of the kernel thread handler. Specifically, the backend expects the handler to reset a certain pointer when stopped, but due to a race condition, the handler may not have enough time to run if the frontend rapidly switches between connect and disconnect states. As a result, the block backend may reuse a pointer that has already been freed. This can be exploited by a malicious guest to continuously connect and disconnect a block frontend, triggering a crash in the dom0 (privileged domain) and potentially leading to privilege escalation and information leaks.
How To Fix
Minimum fixed version
5.10.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade linux-ltsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to follow the recommended fix and update the affected packages to the latest versions.
Conclusion
The Linux kernel PV block backend vulnerability (CVE-2020-29569) poses a risk to systems running the affected versions of the Linux kernel and Xen. To mitigate this vulnerability, it is crucial to update the Linux kernel to version 5.10.4 or later and Xen to a fixed version, if available. Regularly checking for updates and promptly applying them is essential for maintaining the security of the system. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for linux-lts →
FAQ
The vulnerability can lead to a dom0 crash in systems using the Linux kernel PV block backend with Xen. It may also result in privilege escalation and information leaks.
Systems running the Linux kernel through version 5.10.1 and Xen through version 4.14.x are affected by this vulnerability.
While a specific exploit has not been disclosed, a misbehaving guest can trigger the vulnerability by continuously connecting and disconnecting a block frontend.
The recommended mitigation is to update the affected packages to the latest versions provided by the package maintainers.
More information about this vulnerability can be found in the CVE-2020-29569 entry in the National Vulnerability Database (NVD) or on the Vulert website.
Related vulnerabilities
Recent vulnerabilities recorded for linux-lts.
