[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[oss-security] CVE-2021-20261: kernel: panic in start_motor+0x21 when /dev/fd0 is read by multiple threads.


A race condition was found in the Linux kernels implementation of the
floppy disk drive controller driver software.  The impact of this issue is
lessened by the fact that the default permissions on the floppy device
(/dev/fd0) are restricted to root.  If the permissions on the device have
changed the impact changes greatly.  In the default configuration root (or
equivalent) permissions are required to attack this flaw.


"In case of multiple threads trying to open("/dev/fdX"), this leads to
serious corruptions all over the place, because all of a sudden there is no
critical section protection (that'd otherwise be guaranteed by locked fd)

It is likely that this memory corruption will at minimum crash the system,
at worse corrupt memory and lead to possible privilege escalation.

Fixed in:

Red Hat Bugzilla:

To answer the inevitable question that is coming: I'm reporting this
because it is my job.   ;)

Thank you


Wade Mealing

Product Security - Kernel, RHCE

Red Hat


wmealing AT redhat.com
TRIED. TESTED. TRUSTED. <https://redhat.com/trusted>

secalert AT redhat.com for urgent response