Memory leak in Linux kernel - CVE-2020-15393

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU31921

Memory leak in Linux kernel - CVE-2020-15393

Published: July 27, 2020


Vulnerability identifier: #VU31921
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-15393
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak in "drivers/usb/misc/usbtest.c" file. A local user can force the application to leak memory and perform denial of service attack.


Affected software

Linux kernel
SUSE Linux Enterprise Server
Slackware Linux
Ubuntu
Opensuse
kernel-xen
kernel-ec2
kernel-default-devel
kernel-default-base
kernel-default
kernel-ec2-base
kernel-ec2-devel
kernel-source
kernel-syms
kernel-trace
kernel-trace-base
kernel-trace-devel
kernel-xen-base
kernel-xen-devel
linux-image-generic-lpae-lts-xenial (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-powerpc-e500mc-lts-xenial (Ubuntu package)
linux-image-powerpc-smp-lts-xenial (Ubuntu package)
linux-image-powerpc64-emb-lts-xenial (Ubuntu package)
linux-image-powerpc64-smp-lts-xenial (Ubuntu package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-powerpc-e500mc (Ubuntu package)
linux-image-powerpc-smp (Ubuntu package)
linux-image-powerpc64-emb (Ubuntu package)
linux-image-powerpc64-smp (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-4.4.0-187-generic-lpae (Ubuntu package)
linux-image-4.4.0-187-powerpc64-smp (Ubuntu package)
linux-image-4.4.0-187-powerpc64-emb (Ubuntu package)
linux-image-4.4.0-187-powerpc-smp (Ubuntu package)
linux-image-4.4.0-187-powerpc-e500mc (Ubuntu package)
linux-image-4.4.0-187-lowlatency (Ubuntu package)
linux-image-4.4.0-187-generic (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1076-aws (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-1078-kvm (Ubuntu package)
linux-image-4.4.0-1112-aws (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.4.0-1137-raspi2 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.4.0-1141-snapdragon (Ubuntu package)
kernel-default-base-debuginfo
kernel-default-debuginfo
kernel-default-debugsource
kernel-devel
kernel-macros
linux-4.4.240/kernel-modules
linux-4.4.240/kernel-huge
linux-4.4.240/kernel-generic
linux-4.4.240/kernel-headers
linux-image-4.15.0-115-generic (Ubuntu package)
linux-image-4.15.0-115-generic-lpae (Ubuntu package)
linux-image-4.15.0-115-lowlatency (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1051-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1067-gke (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-4.15.0-1068-raspi2 (Ubuntu package)
linux-image-4.15.0-1072-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1080-aws (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-4.15.0-1081-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1084-snapdragon (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-edge (Ubuntu package)
linux-image-4.15.0-1093-azure (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-4.15.0-1094-oem (Ubuntu package)
linux-image-5.3.0-65-lowlatency (Ubuntu package)
linux-image-5.3.0-65-generic (Ubuntu package)
linux-image-gkeop-5.3 (Ubuntu package)
linux-image-gke-5.3 (Ubuntu package)
linux-image-5.3.0-1033-aws (Ubuntu package)
linux-image-5.3.0-1033-gke (Ubuntu package)
linux-image-5.3.0-1035-azure (Ubuntu package)
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-45-lowlatency (Ubuntu package)
linux-image-5.4.0-45-generic-lpae (Ubuntu package)
linux-image-5.4.0-45-generic (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-gkeop-5.4 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1016-raspi (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-aws-edge (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-5.4.0-1022-oracle (Ubuntu package)
linux-image-5.4.0-1022-gcp (Ubuntu package)
linux-image-5.4.0-1022-aws (Ubuntu package)
linux-image-5.4.0-1023-azure (Ubuntu package)

How to mitigate CVE-2020-15393

Install updates from vendor's website.

Linux kernel - update to 5.7.7
kernel-xen - update to 3.0.101-108.138.1
kernel-ec2 - update to 3.0.101-108.138.1
kernel-default-devel - addressed in versions 3.0.101-108.138.1, 4.4.121-92.181.1, 4.4.180-94.171.1
kernel-default-base - addressed in versions 3.0.101-108.138.1, 4.4.121-92.181.1, 4.4.180-94.171.1
kernel-default - addressed in versions 3.0.101-108.138.1, 4.4.121-92.181.1, 4.4.180-94.171.1
kernel-ec2-base - update to 3.0.101-108.138.1
kernel-ec2-devel - update to 3.0.101-108.138.1
kernel-source - addressed in versions 3.0.101-108.138.1, 4.4.121-92.181.1, 4.4.180-94.171.1
kernel-syms - addressed in versions 3.0.101-108.138.1, 4.4.121-92.181.1, 4.4.180-94.171.1
kernel-trace - update to 3.0.101-108.138.1
kernel-trace-base - update to 3.0.101-108.138.1
kernel-trace-devel - update to 3.0.101-108.138.1
kernel-xen-base - update to 3.0.101-108.138.1
kernel-xen-devel - update to 3.0.101-108.138.1
linux-image-generic-lpae-lts-xenial (Ubuntu package) - update to 4.4.0.187.164
linux-image-generic-lts-xenial (Ubuntu package) - update to 4.4.0.187.164
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to 4.4.0.187.164
linux-image-powerpc-e500mc-lts-xenial (Ubuntu package) - update to 4.4.0.187.164
linux-image-powerpc-smp-lts-xenial (Ubuntu package) - update to 4.4.0.187.164
linux-image-powerpc64-emb-lts-xenial (Ubuntu package) - update to 4.4.0.187.164
linux-image-powerpc64-smp-lts-xenial (Ubuntu package) - update to 4.4.0.187.164
linux-image-virtual-lts-xenial (Ubuntu package) - update to 4.4.0.187.164
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.4.0.187.193, 4.15.0.115.103, 5.4.0.45.49
linux-image-generic (Ubuntu package) - addressed in versions 4.4.0.187.193, 4.15.0.115.103, 5.4.0.45.49
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.4.0.187.193, 4.15.0.115.103, 5.4.0.45.49
linux-image-powerpc-e500mc (Ubuntu package) - update to 4.4.0.187.193
linux-image-powerpc-smp (Ubuntu package) - update to 4.4.0.187.193
linux-image-powerpc64-emb (Ubuntu package) - update to 4.4.0.187.193
linux-image-powerpc64-smp (Ubuntu package) - update to 4.4.0.187.193
linux-image-virtual (Ubuntu package) - addressed in versions 4.4.0.187.193, 4.15.0.115.103, 5.4.0.45.49
linux-image-4.4.0-187-generic-lpae (Ubuntu package) - addressed in versions 4.4.0-187.217, 4.4.0-187.217~14.04.1
linux-image-4.4.0-187-powerpc64-smp (Ubuntu package) - addressed in versions 4.4.0-187.217, 4.4.0-187.217~14.04.1
linux-image-4.4.0-187-powerpc64-emb (Ubuntu package) - addressed in versions 4.4.0-187.217, 4.4.0-187.217~14.04.1
linux-image-4.4.0-187-powerpc-smp (Ubuntu package) - addressed in versions 4.4.0-187.217, 4.4.0-187.217~14.04.1
linux-image-4.4.0-187-powerpc-e500mc (Ubuntu package) - addressed in versions 4.4.0-187.217, 4.4.0-187.217~14.04.1
linux-image-4.4.0-187-lowlatency (Ubuntu package) - addressed in versions 4.4.0-187.217, 4.4.0-187.217~14.04.1
linux-image-4.4.0-187-generic (Ubuntu package) - addressed in versions 4.4.0-187.217, 4.4.0-187.217~14.04.1
linux-image-aws (Ubuntu package) - addressed in versions 4.4.0.1076.73, 4.4.0.1112.117, 5.3.0.1033.32, 5.4.0.1022.23
linux-image-4.4.0-1076-aws (Ubuntu package) - update to 4.4.0-1076.80
linux-image-kvm (Ubuntu package) - addressed in versions 4.4.0.1078.76, 4.15.0.1072.68, 5.4.0.1021.20
linux-image-4.4.0-1078-kvm (Ubuntu package) - update to 4.4.0-1078.85
linux-image-4.4.0-1112-aws (Ubuntu package) - update to 4.4.0-1112.124
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.4.0.1137.137, 4.15.0.1068.66, 5.4.0.1016.51
linux-image-4.4.0-1137-raspi2 (Ubuntu package) - update to 4.4.0-1137.146
linux-image-snapdragon (Ubuntu package) - addressed in versions 4.4.0.1141.133, 4.15.0.1084.87
linux-image-4.4.0-1141-snapdragon (Ubuntu package) - update to 4.4.0-1141.149
kernel-default-base-debuginfo - addressed in versions 4.4.121-92.181.1, 4.4.180-94.171.1
kernel-default-debuginfo - addressed in versions 4.4.121-92.181.1, 4.4.180-94.171.1
kernel-default-debugsource - addressed in versions 4.4.121-92.181.1, 4.4.180-94.171.1
kernel-devel - addressed in versions 4.4.121-92.181.1, 4.4.180-94.171.1
kernel-macros - addressed in versions 4.4.121-92.181.1, 4.4.180-94.171.1
linux-4.4.240/kernel-modules - update to 4.4.240
linux-4.4.240/kernel-huge - update to 4.4.240
linux-4.4.240/kernel-generic - update to 4.4.240
linux-4.4.240/kernel-headers - update to 4.4.240_smp
linux-image-4.15.0-115-generic (Ubuntu package) - update to 4.15.0-115.116~16.04.1
linux-image-4.15.0-115-generic-lpae (Ubuntu package) - update to 4.15.0-115.116~16.04.1
linux-image-4.15.0-115-lowlatency (Ubuntu package) - update to 4.15.0-115.116~16.04.1
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1051.42, 5.4.0.1022.7, 5.4.0.1022.20
linux-image-4.15.0-1051-oracle (Ubuntu package) - addressed in versions 4.15.0-1051.55, 4.15.0-1051.55~16.04.1
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1051.62
linux-image-4.15.0-1067-gke (Ubuntu package) - update to 4.15.0-1067.70
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1067.71
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1067.71, 4.15.0.1081.83, 5.4.0.1022.20
linux-image-4.15.0-1068-raspi2 (Ubuntu package) - update to 4.15.0-1068.72
linux-image-4.15.0-1072-kvm (Ubuntu package) - update to 4.15.0-1072.73
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1080.77
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1080.82
linux-image-4.15.0-1080-aws (Ubuntu package) - addressed in versions 4.15.0-1080.84, 4.15.0-1080.84~16.04.1
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1081.83, 5.4.0.1022.9, 5.4.0.1022.20
linux-image-4.15.0-1081-gcp (Ubuntu package) - addressed in versions 4.15.0-1081.92, 4.15.0-1081.92~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1081.99
linux-image-4.15.0-1084-snapdragon (Ubuntu package) - update to 4.15.0-1084.92
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1093.67
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1093.70, 4.15.0.1093.88, 5.3.0.1035.31, 5.4.0.1023.7, 5.4.0.1023.22
linux-image-azure-edge (Ubuntu package) - update to 4.15.0.1093.88
linux-image-4.15.0-1093-azure (Ubuntu package) - addressed in versions 4.15.0-1093.103, 4.15.0-1093.103~14.04.1, 4.15.0-1093.103~16.04.1
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.1094.98, 5.4.0.45.49
linux-image-4.15.0-1094-oem (Ubuntu package) - update to 4.15.0-1094.104
linux-image-5.3.0-65-lowlatency (Ubuntu package) - update to 5.3.0-65.59
linux-image-5.3.0-65-generic (Ubuntu package) - update to 5.3.0-65.59
linux-image-gkeop-5.3 (Ubuntu package) - update to 5.3.0.65.121
linux-image-gke-5.3 (Ubuntu package) - update to 5.3.0.1033.18
linux-image-5.3.0-1033-aws (Ubuntu package) - update to 5.3.0-1033.35
linux-image-5.3.0-1033-gke (Ubuntu package) - update to 5.3.0-1033.35
linux-image-5.3.0-1035-azure (Ubuntu package) - update to 5.3.0-1035.36
linux-image-oem-osp1 (Ubuntu package) - update to 5.4.0.45.49
linux-image-5.4.0-45-lowlatency (Ubuntu package) - update to 5.4.0-45.49~18.04.2
linux-image-5.4.0-45-generic-lpae (Ubuntu package) - update to 5.4.0-45.49~18.04.2
linux-image-5.4.0-45-generic (Ubuntu package) - update to 5.4.0-45.49~18.04.2
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-gkeop-5.4 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.45.49~18.04.38
linux-image-5.4.0-1016-raspi (Ubuntu package) - update to 5.4.0-1016.17~18.04.1
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1016.20
linux-image-raspi (Ubuntu package) - update to 5.4.0.1016.51
linux-image-aws-edge (Ubuntu package) - update to 5.4.0.1022.8
linux-image-gke-5.4 (Ubuntu package) - update to 5.4.0.1022.9
linux-image-5.4.0-1022-oracle (Ubuntu package) - update to 5.4.0-1022.22~18.04.1
linux-image-5.4.0-1022-gcp (Ubuntu package) - update to 5.4.0-1022.22~18.04.1
linux-image-5.4.0-1022-aws (Ubuntu package) - update to 5.4.0-1022.22~18.04.1
linux-image-5.4.0-1023-azure (Ubuntu package) - update to 5.4.0-1023.23~18.04.1

External References

Related Security Bulletins