CVE-2019-20812: 
Linux Kernel vulnerability analysis and mitigation

CVE-2019-20812 is a vulnerability discovered in the Linux kernel before version 5.4.7. The issue affects the prb_calc_retire_blk_tmo() function in net/packet/af_packet.c, which can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3 (NVD, Debian).

The vulnerability occurs when __ethtool_get_link_ksettings() fails in prb_calc_retire_blk_tmo(), causing msec and tmo variables to be zero. This results in tov_in_jiffies being zero, which causes the timer expire for retire_blk_timer to be set to mod_timer(&pkc->retire_blk_timer, jiffies + 0). This condition triggers CPU usage of softirq to reach 100% (Kernel Commit).

The vulnerability can lead to a denial of service condition through excessive CPU consumption and soft lockup of the system. This affects the system's performance and availability when processing network packets using the TPACKET_V3 interface (Red Hat).

The vulnerability requires local access to the system and the ability to interact with the packet socket interface. While it is locally exploitable, it does not require special privileges beyond the ability to use packet sockets (Debian).

The issue was fixed in Linux kernel version 5.4.7 with commit b43d1f9f7067. The fix involves setting a default value (DEFAULT_PRB_RETIRE_TOV) for the retirement timeout when __ethtool_get_link_ksettings() fails (Kernel Commit).