Race Condition Affecting kernel-bootwrapper package, versions <0:3.10.0-1160.el7
Threat Intelligence
EPSS
0.98% (84th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL7-KERNELBOOTWRAPPER-1530523
- published 26 Jul 2021
- disclosed 25 Sep 2018
How to fix?
Upgrade RHEL:7 kernel-bootwrapper to version 0:3.10.0-1160.el7 or higher.
This issue was patched in RHSA-2020:4060.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-bootwrapper package and not the kernel-bootwrapper package as distributed by RHEL.
See How to fix? for RHEL:7 relevant fixed versions and status.
An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free.
References
- http://www.securityfocus.com/bid/108196
- https://seclists.org/bugtraq/2019/Aug/13
- https://seclists.org/bugtraq/2019/Aug/18
- https://security.netapp.com/advisory/ntap-20190719-0003/
- https://support.f5.com/csp/article/K11225249
- https://access.redhat.com/security/cve/CVE-2018-20836
- https://www.debian.org/security/2019/dsa-4495
- https://www.debian.org/security/2019/dsa-4497
- https://github.com/torvalds/linux/commit/b90cd6f2b905905fb42671009dc0e27c310a16ae
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b90cd6f2b905905fb42671009dc0e27c310a16ae
- https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html
- https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html
- https://access.redhat.com/errata/RHSA-2020:4060
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html
- https://usn.ubuntu.com/4076-1/
CVSS Scores
version 3.1