Main Vulnerability Database Vulnerabilities #VU34808

Buffer overflow in Linux kernel and Fedora - CVE-2020-9391

Published: February 25, 2020 / Updated: August 8, 2020

Vulnerability identifier: #VU34808

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9391

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation.

Affected software

Linux kernel
Fedora
kernel-headers
kernel-tools
kernel

How to mitigate CVE-2020-9391

Install update from vendor's website.

kernel-headers - update to 5.5.6-200.fc31
kernel-tools - update to 5.5.6-200.fc31
kernel - update to 5.5.6-201.fc31

External References

Related Security Bulletins