CVE-2020-12652

CVE Details

Release Date:	2020-05-05
Impact:	None	What is this?

Description

The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition, i.e., a "double fetch" vulnerability, aka CID-28d76df18f0a. NOTE: the vendor states "The security impact of this bug is not as bad as it could have been because these operations are all privileged and root already has enormous destructive power."

See more information about CVE-2020-12652 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	4.1
Vector String:	CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Version:	3.0
Attack Vector:	Local
Attack Complexity:	High
Privileges Required:	High
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	None
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (kernel-uek)	ELSA-2021-9002	2021-01-07
Oracle Linux version 7 (kernel-uek)	ELSA-2020-5755	2020-07-10
Oracle Linux version 7 (kernel-uek)	ELSA-2021-9002	2021-01-07
Oracle VM version 3.4 (kernel-uek)	OVMSA-2021-0001	2021-01-07