CVE-2020-28941: Linux Kernel Speakup Driver DoS Flaw

CVE-2020-28941 Overview

CVE-2020-28941 is a vulnerability discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through version 5.9.9. Local attackers on systems with the speakup driver enabled could cause a local denial of service attack. This vulnerability is tracked as CID-d41227544427 and occurs due to an invalid free when the line discipline is used more than once.

Critical Impact

Local attackers can trigger an invalid free condition in the speakup accessibility driver, causing system instability or denial of service on affected Linux systems.

Affected Products

• Linux Kernel (versions through 5.9.9)
• Fedora 32 and 33
• Debian Linux 9.0

Discovery Timeline

• November 19, 2020 - CVE-2020-28941 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-28941

Vulnerability Analysis

The vulnerability resides in the speakup driver's TTY I/O handling code within drivers/accessibility/speakup/spk_ttyio.c. The speakup driver is an accessibility component that provides a software-based speech synthesizer for the Linux kernel, allowing visually impaired users to interact with the system through audio feedback.

The root issue is a lack of proper synchronization and state management when the line discipline is attached to the TTY device. When a local attacker uses the line discipline multiple times, the driver fails to properly track the allocation state, leading to an invalid free operation that corrupts kernel memory structures and results in a denial of service condition.

Root Cause

The vulnerability stems from missing mutex protection and state validation in the line discipline open function. The original code did not check whether speakup_tty was already in use before allowing another attachment, and lacked proper synchronization when accessing the shared speakup_tty pointer. This allowed concurrent or repeated use of the line discipline to trigger double-free or use-after-free conditions when the allocated ldisc_data structure was freed.

Attack Vector

The attack requires local access to the system with the speakup driver loaded. An attacker can exploit this vulnerability by repeatedly attaching the speakup line discipline to TTY devices, triggering the invalid free condition. While this vulnerability does not allow code execution or information disclosure, it can effectively render the system unusable, impacting system availability.

// Security patch demonstrating the fix
// Source: https://github.com/torvalds/linux/commit/d4122754442799187d5d537a9c039a49a67e57f1
 
 	if (!tty->ops->write)
 		return -EOPNOTSUPP;

+	mutex_lock(&speakup_tty_mutex);
+	if (speakup_tty) {
+		mutex_unlock(&speakup_tty_mutex);
+		return -EBUSY;
+	}
 	speakup_tty = tty;

 	ldisc_data = kmalloc(sizeof(*ldisc_data), GFP_KERNEL);
-	if (!ldisc_data)
+	if (!ldisc_data) {
+		speakup_tty = NULL;
+		mutex_unlock(&speakup_tty_mutex);
 		return -ENOMEM;
+	}

 	init_completion(&ldisc_data->completion);
 	ldisc_data->buf_free = true;
 	speakup_tty->disc_data = ldisc_data;
+	mutex_unlock(&speakup_tty_mutex);

 	return 0;
}

The patch adds mutex protection around the speakup_tty assignment and validates that the driver isn't already in use before proceeding, preventing the invalid free condition.

Detection Methods for CVE-2020-28941

Indicators of Compromise

• Unexpected kernel panics or system crashes related to TTY subsystem operations
• Kernel log messages referencing speakup driver errors or memory corruption
• Repeated attempts to access speakup line discipline from local user sessions

Detection Strategies

• Monitor kernel logs for messages containing speakup, spk_ttyio, or double-free/use-after-free indicators
• Implement system auditing to track access attempts to speakup driver device files
• Deploy kernel crash dump analysis tools to identify exploitation attempts targeting this vulnerability

Monitoring Recommendations

• Configure auditd rules to log interactions with TTY devices when speakup driver is loaded
• Set up automated alerting for kernel oops or panic messages associated with the accessibility subsystem
• Monitor for unusual patterns of line discipline attachment operations on production systems

How to Mitigate CVE-2020-28941

Immediate Actions Required

• Update the Linux kernel to a patched version that includes commit d4122754442799187d5d537a9c039a49a67e57f1
• Apply distribution-specific security updates from Fedora or Debian if applicable
• Disable or unload the speakup kernel module on systems where it is not required

Patch Information

The vulnerability was addressed in the Linux kernel through commit d4122754442799187d5d537a9c039a49a67e57f1. Security advisories and patches are available from multiple sources:

• Linux Kernel Git Commit
• GitHub Linux Kernel Commit
• Debian LTS Security Announcement
• Openwall OSS Security List Disclosure

Workarounds

• Unload the speakup kernel module using modprobe -r speakup if it is not required for accessibility features
• Blacklist the speakup module by adding blacklist speakup to /etc/modprobe.d/blacklist.conf to prevent automatic loading
• Restrict local user access to TTY devices through appropriate file permissions and access control policies

# Configuration example - Disable speakup driver
# Unload the speakup module if currently loaded
sudo modprobe -r speakup

# Prevent the speakup module from loading at boot
echo "blacklist speakup" | sudo tee /etc/modprobe.d/speakup-blacklist.conf

# Verify the module is not loaded
lsmod | grep speakup