Out-of-bounds read in Linux kernel - CVE-2020-9383

Vulnerability identifier: #VU25813

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9383

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the set_fdc() function in drivers/block/floppy.c file in Linux kernel due to the FDC index is not checked for errors before assigning it. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Linux kernel
Arch Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Workstation
Slackware Linux
Opensuse
kernel (Red Hat package)
kernel-rt (Red Hat package)
linux-4.4.217/kernel-generic
linux-4.4.217/kernel-huge
linux-4.4.217/kernel-modules
linux-4.4.217/kernel-headers
kernel-alt (Red Hat package)

Install updates from vendor's website.

Linux kernel - update to 5.5.7
kernel (Red Hat package) - update to 3.10.0-1160.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.rt56.1131.el7
linux-4.4.217/kernel-generic - update to 4.4.217
linux-4.4.217/kernel-huge - update to 4.4.217
linux-4.4.217/kernel-modules - update to 4.4.217
linux-4.4.217/kernel-headers - update to 4.4.217_smp
kernel-alt (Red Hat package) - update to 4.14.0-115.21.2.el7a

• https://github.com/torvalds/linux/commit/2e90ca68b0d2f5548804f22f0dd61145516171e3

• Multiple vulnerabilities in Linux kernel
• Arch Linux update for Linux
• OpenSUSE Linux update for the Linux Kernel
• Red Hat Enterprise Linux 7 update for kernel-alt
• Slackware Linux update for kernel
• Red Hat Enterprise Linux 7 update for kernel-rt
• Red Hat Enterprise Linux 7 update for kernel