CVE-2020-29661 Use after free in n/a
High 7.8
Published
Updated
Check this codebase for CVE-2020-29661 and fix it if it is affected.
What it is: CVE-2020-29661 is a high-severity use after free vulnerability in Broadcom Fabric Operating System, published on 9 Dec 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2020-29661 in the wild and no public exploit code.
Affected product: Broadcom Fabric Operating System. No package-level version data is available, so check the vendor advisory linked from the reference page.
Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.
Reference: https://insights.sbomify.com/CVE-2020-29661/ (Markdown: https://insights.sbomify.com/CVE-2020-29661/index.md)
A use-after-free vulnerability in the Linux kernel tty subsystem allows local attackers to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-29661?
CVE-2020-29661 is a high-severity use after free vulnerability in Broadcom Fabric Operating System, published on 9 Dec 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
Which versions are affected by CVE-2020-29661?
It affects 12 products.
Linux distribution packages (40)
kpatch-patch-3_10_0-957_46_1 Red Hat:rhel_eus:7.6::server | All versions | 0:1-4.el7 |
kpatch-patch-3_10_0-957_48_1 Red Hat:rhel_eus:7.6::server | All versions | 0:1-4.el7 |
kpatch-patch-3_10_0-957_54_1 Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_54_1-debuginfo Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_56_1 Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_56_1-debuginfo Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_58_2 Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_58_2-debuginfo Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_61_1 Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_61_1-debuginfo Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_61_2 Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_61_2-debuginfo Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_62_1 Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_62_1-debuginfo Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_65_1 Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_65_1-debuginfo Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_66_1 Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-957_66_1-debuginfo Red Hat:rhel_eus:7.6::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_21_1 Red Hat:rhel_eus:7.7::server | All versions | 0:1-3.el7 |
kpatch-patch-3_10_0-1062_21_1-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-3.el7 |
kpatch-patch-3_10_0-1062_26_1 Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_26_1-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_30_1 Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_30_1-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_31_2 Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_31_2-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_31_3 Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_31_3-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_33_1 Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_33_1-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_36_1 Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_36_1-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_37_1 Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_37_1-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_40_1 Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_40_1-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_43_1 Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_43_1-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_45_1 Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1062_45_1-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1-1.el7 |
Products include Broadcom Fabric Operating System, Debian Debian Linux, Fedoraproject Fedora, Linux kernel, Netapp 8300 Firmware, Netapp 8700 Firmware and 6 more.
How do I fix CVE-2020-29661?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2020-29661 being exploited?
There is no known exploitation of CVE-2020-29661 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Broadcom Fabric Operating System
Sources
Also known as A-175451802, ASB-A-175451802, DEBIAN-CVE-2020-29661, GHSA-p865-45gc-8x47, RHSA-2021:0940, RHSA-2021:1031 and 1 more.