SB2020112804 - Memory leak in Linux kernel romfs
Published: November 28, 2020
Security Bulletin ID
SB2020112804
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Memory leak (CVE-ID: CVE-2020-29371)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to memory leak within the romfs_dev_read() function in fs/romfs/storage.c. A local user can gain access to sensitive information.
Remediation
Install update from vendor's website.
References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2077
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.4
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2935e0a3cec1ffa558eea90db6279cff83aa3592
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bcf85fcedfdd17911982a3e3564fcfec7b01eebd