Loading vulnerability…
Linux Kernel TTY TIOCSPGRP Use-After-Free
CVE-2020-29661 is a use-after-free vulnerability caused by improper locking in the Linux kernel TTY subsystem's job-control handling. The flaw affects the TIOCSPGRP ioctl operation in unpatched kernels through version 5.9.13. A local attacker with low privileges can potentially trigger access to freed kernel memory, resulting in memory corruption, privilege escalation, or denial of service. Distribution kernels may contain backported fixes without a change to their upstream base version.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise kernel memory safety and potentially allow a low-privileged local attacker to elevate privileges or execute unauthorized code with kernel privileges. Invalid memory accesses can also crash the system and cause denial of service. Exploitation can therefore affect confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
No practical vulnerability-specific mitigation meeting Red Hat Product Security's usability, deployment, applicability, and stability criteria was identified. Apply the appropriate kernel update or supported live patch rather than relying on a workaround.
Patch, then assume compromise.
Install a vendor-supported kernel update containing upstream fix 54ffccbf053b5b6ca4f6e45094b942fab92a25fc or its distribution backport, and reboot into the updated kernel. Examples of fixed Red Hat builds include 3.10.0-1160.21.1.el7 for RHEL 7, 4.18.0-147.43.1.el8_1 for RHEL 8.1 EUS, and 4.18.0-193.46.1.el8_2 for RHEL 8.2 EUS. Supported RHEL streams also offer corresponding kpatch live updates that modify the running kernel without a conventional reboot. For affected Android devices, install the vendor update providing security patch level 2021-05-05 or later. Verify remediation against the applicable vendor advisory rather than relying solely on the upstream kernel version.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.