Out-of-bounds read in Linux kernel - CVE-2020-14314

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU47106

Out-of-bounds read in Linux kernel - CVE-2020-14314

Published: September 15, 2020 / Updated: September 26, 2020


Vulnerability identifier: #VU47106
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-14314
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists.


Affected software

Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Anolis OS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Slackware Linux
Ubuntu
Opensuse
openEuler
BIG-IQ Centralized Management
BIG-IP DDHD
BIG-IP SSLO
BIG-IP
BIG-IP AFM
BIG-IP ASM
BIG-IP PEM
BIG-IP APM
BIG-IP FPS
BIG-IP LTM
BIG-IP Analytics
BIG-IP GTM
BIG-IP Link Controller
BIG-IP DNS
BIG-IP AAM
IBM RackSwitch G7028
IBM RackSwitch G8332
G8264CS_SI_Fabric_Image
IBM RackSwitch G8264CS
IBM Flex System EN2092 1Gb Ethernet Scalable Switch
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch
IBM Flex System CN4093 10Gb Converged Scalable Switch
IBM RackSwitch G8264T
IBM RackSwitch G8316
IBM RackSwitch G8264
IBM RackSwitch G8052
IBM RackSwitch G8124
IBM RackSwitch G8124E
BIG-IP Advanced WAF
kernel (Red Hat package)
kernel-rt (Red Hat package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-generic-lpae-lts-xenial (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-powerpc-e500mc (Ubuntu package)
linux-image-powerpc-smp (Ubuntu package)
linux-image-powerpc64-emb (Ubuntu package)
linux-image-powerpc64-smp (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-4.4.0-193-generic-lpae (Ubuntu package)
linux-image-4.4.0-193-powerpc64-emb (Ubuntu package)
linux-image-4.4.0-193-lowlatency (Ubuntu package)
linux-image-4.4.0-193-powerpc64-smp (Ubuntu package)
linux-image-4.4.0-193-powerpc-e500mc (Ubuntu package)
linux-image-4.4.0-193-powerpc-smp (Ubuntu package)
linux-image-4.4.0-193-generic (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1081-aws (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-1082-kvm (Ubuntu package)
linux-image-4.4.0-1117-aws (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.4.0-1141-raspi2 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.4.0-1145-snapdragon (Ubuntu package)
linux-4.4.240/kernel-generic
linux-4.4.240/kernel-modules
linux-4.4.240/kernel-huge
linux-4.4.240/kernel-headers
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-4.15.0-120-generic (Ubuntu package)
linux-image-4.15.0-120-lowlatency (Ubuntu package)
linux-image-4.15.0-120-generic-lpae (Ubuntu package)
linux-image-4.15.0-121-generic (Ubuntu package)
linux-image-4.15.0-121-generic-lpae (Ubuntu package)
linux-image-4.15.0-121-lowlatency (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1056-oracle (Ubuntu package)
linux-image-4.15.0-1057-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-4.15.0-1072-gke (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-4.15.0-1073-raspi2 (Ubuntu package)
linux-image-4.15.0-1077-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-4.15.0-1085-aws (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1086-aws (Ubuntu package)
linux-image-4.15.0-1086-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1089-snapdragon (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-4.15.0-1098-azure (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1099-oem (Ubuntu package)
linux-image-4.15.0-1099-azure (Ubuntu package)
bpftool-debuginfo
kernel
kernel-debuginfo
kernel-debugsource
bpftool
kernel-devel
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python2-perf
python2-perf-debuginfo
python3-perf
python3-perf-debuginfo
kernel-tools-libs-devel
kernel-tools-libs
kernel-headers
kernel-debug-devel
kernel-debug
python-perf
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-oem-osp1 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-5.4.0-51-lowlatency (Ubuntu package)
linux-image-5.4.0-51-generic-lpae (Ubuntu package)
linux-image-5.4.0-51-generic (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1021-raspi (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1026-kvm (Ubuntu package)
linux-image-5.4.0-1028-oracle (Ubuntu package)
linux-image-5.4.0-1028-gcp (Ubuntu package)
linux-image-5.4.0-1028-aws (Ubuntu package)
linux-image-5.4.0-1031-azure (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.6.0-1048-oem (Ubuntu package)
Data Computing Appliance (DCA)
Flex System Fabric EN4093/EN4093R 10Gb Scalable Switch
IBM QRadar Network Security
Session Smart Router

How to mitigate CVE-2020-14314

Install update from vendor's website.

kernel (Red Hat package) - update to 3.10.0-1160.11.1.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.11.1.rt56.1145.el7
Data Computing Appliance (DCA) - update to 4.3.0.0
linux-image-virtual-lts-xenial (Ubuntu package) - update to 4.4.0.193.169
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to 4.4.0.193.169
linux-image-generic-lts-xenial (Ubuntu package) - update to 4.4.0.193.169
linux-image-generic-lpae-lts-xenial (Ubuntu package) - update to 4.4.0.193.169
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.4.0.193.199, 4.15.0.121.108, 5.4.0.51.54
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.4.0.193.199, 4.15.0.121.108, 5.4.0.51.54
linux-image-powerpc-e500mc (Ubuntu package) - update to 4.4.0.193.199
linux-image-powerpc-smp (Ubuntu package) - update to 4.4.0.193.199
linux-image-powerpc64-emb (Ubuntu package) - update to 4.4.0.193.199
linux-image-powerpc64-smp (Ubuntu package) - update to 4.4.0.193.199
linux-image-generic (Ubuntu package) - addressed in versions 4.4.0.193.199, 4.15.0.121.108, 5.4.0.51.54
linux-image-virtual (Ubuntu package) - addressed in versions 4.4.0.193.199, 4.15.0.121.108, 5.4.0.51.54
linux-image-4.4.0-193-generic-lpae (Ubuntu package) - addressed in versions 4.4.0-193.224, 4.4.0-193.224~14.04.1
linux-image-4.4.0-193-powerpc64-emb (Ubuntu package) - update to 4.4.0-193.224
linux-image-4.4.0-193-lowlatency (Ubuntu package) - addressed in versions 4.4.0-193.224, 4.4.0-193.224~14.04.1
linux-image-4.4.0-193-powerpc64-smp (Ubuntu package) - update to 4.4.0-193.224
linux-image-4.4.0-193-powerpc-e500mc (Ubuntu package) - update to 4.4.0-193.224
linux-image-4.4.0-193-powerpc-smp (Ubuntu package) - update to 4.4.0-193.224
linux-image-4.4.0-193-generic (Ubuntu package) - addressed in versions 4.4.0-193.224, 4.4.0-193.224~14.04.1
linux-image-aws (Ubuntu package) - addressed in versions 4.4.0.1081.78, 4.4.0.1117.122, 5.4.0.1028.13, 5.4.0.1028.29
linux-image-4.4.0-1081-aws (Ubuntu package) - update to 4.4.0-1081.85
linux-image-kvm (Ubuntu package) - addressed in versions 4.4.0.1082.80, 4.15.0.1077.73, 5.4.0.1026.24
linux-image-4.4.0-1082-kvm (Ubuntu package) - update to 4.4.0-1082.91
linux-image-4.4.0-1117-aws (Ubuntu package) - update to 4.4.0-1117.131
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.4.0.1141.141, 4.15.0.1073.70, 5.4.0.1021.56
linux-image-4.4.0-1141-raspi2 (Ubuntu package) - update to 4.4.0-1141.151
linux-image-snapdragon (Ubuntu package) - addressed in versions 4.4.0.1145.137, 4.15.0.1089.92
linux-image-4.4.0-1145-snapdragon (Ubuntu package) - update to 4.4.0-1145.155
linux-4.4.240/kernel-generic - update to 4.4.240
linux-4.4.240/kernel-modules - update to 4.4.240
linux-4.4.240/kernel-huge - update to 4.4.240
linux-4.4.240/kernel-headers - update to 4.4.240_smp
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-generic-lpae-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.120.121, 4.15.0.1099.103, 5.4.0.51.54
linux-image-4.15.0-120-generic (Ubuntu package) - update to 4.15.0-120.122~16.04.1
linux-image-4.15.0-120-lowlatency (Ubuntu package) - update to 4.15.0-120.122~16.04.1
linux-image-4.15.0-120-generic-lpae (Ubuntu package) - update to 4.15.0-120.122~16.04.1
linux-image-4.15.0-121-generic (Ubuntu package) - update to 4.15.0-121.123
linux-image-4.15.0-121-generic-lpae (Ubuntu package) - update to 4.15.0-121.123
linux-image-4.15.0-121-lowlatency (Ubuntu package) - update to 4.15.0-121.123
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1056.46, 5.4.0.1028.12, 5.4.0.1028.25
linux-image-4.15.0-1056-oracle (Ubuntu package) - update to 4.15.0-1056.61~16.04.1
linux-image-4.15.0-1057-oracle (Ubuntu package) - update to 4.15.0-1057.62
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1057.67
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1072.76
linux-image-4.15.0-1072-gke (Ubuntu package) - update to 4.15.0-1072.76
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1072.76, 4.15.0.1086.87, 5.4.0.1028.36
linux-image-4.15.0-1073-raspi2 (Ubuntu package) - update to 4.15.0-1073.78
linux-image-4.15.0-1077-kvm (Ubuntu package) - update to 4.15.0-1077.79
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1085.81
linux-image-4.15.0-1085-aws (Ubuntu package) - update to 4.15.0-1085.90~16.04.1
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1086.87, 5.4.0.1028.16, 5.4.0.1028.36
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1086.88
linux-image-4.15.0-1086-aws (Ubuntu package) - update to 4.15.0-1086.91
linux-image-4.15.0-1086-gcp (Ubuntu package) - addressed in versions 4.15.0-1086.98, 4.15.0-1086.98~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1086.104
linux-image-4.15.0-1089-snapdragon (Ubuntu package) - update to 4.15.0-1089.98
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1098.74, 4.15.0.1098.92, 5.4.0.1031.13, 5.4.0.1031.29
linux-image-4.15.0-1098-azure (Ubuntu package) - addressed in versions 4.15.0-1098.109~14.04.1, 4.15.0-1098.109~16.04.1
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1099.72
linux-image-4.15.0-1099-oem (Ubuntu package) - update to 4.15.0-1099.109
linux-image-4.15.0-1099-azure (Ubuntu package) - update to 4.15.0-1099.110
bpftool-debuginfo - update to 4.19.90-2010.2.0.0046
kernel - update to 4.19.90-2010.2.0.0046
kernel-debuginfo - update to 4.19.90-2010.2.0.0046
kernel-debugsource - update to 4.19.90-2010.2.0.0046
bpftool - update to 4.19.90-2010.2.0.0046
kernel-devel - update to 4.19.90-2010.2.0.0046
kernel-source - update to 4.19.90-2010.2.0.0046
kernel-tools - update to 4.19.90-2010.2.0.0046
kernel-tools-debuginfo - update to 4.19.90-2010.2.0.0046
kernel-tools-devel - update to 4.19.90-2010.2.0.0046
perf - update to 4.19.90-2010.2.0.0046
perf-debuginfo - update to 4.19.90-2010.2.0.0046
python2-perf - update to 4.19.90-2010.2.0.0046
python2-perf-debuginfo - update to 4.19.90-2010.2.0.0046
python3-perf - update to 4.19.90-2010.2.0.0046
python3-perf-debuginfo - update to 4.19.90-2010.2.0.0046
perf - update to 4.19.91-26
kernel-tools-libs-devel - update to 4.19.91-26
kernel-tools-libs - update to 4.19.91-26
kernel-tools - update to 4.19.91-26
kernel-headers - update to 4.19.91-26
kernel-devel - update to 4.19.91-26
kernel-debug-devel - update to 4.19.91-26
kernel-debug - update to 4.19.91-26
kernel - update to 4.19.91-26
bpftool - update to 4.19.91-26
python-perf - update to 4.19.91-26
IBM QRadar Network Security - addressed in versions 5.4.0.17, 5.5.0.12
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-oem-osp1 (Ubuntu package) - update to 5.4.0.51.54
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-5.4.0-51-lowlatency (Ubuntu package) - update to 5.4.0-51.56~18.04.1
linux-image-5.4.0-51-generic-lpae (Ubuntu package) - update to 5.4.0-51.56~18.04.1
linux-image-5.4.0-51-generic (Ubuntu package) - update to 5.4.0-51.56~18.04.1
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-5.4.0-1021-raspi (Ubuntu package) - update to 5.4.0-1021.24~18.04.1
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1021.25
linux-image-raspi (Ubuntu package) - update to 5.4.0.1021.56
linux-image-5.4.0-1026-kvm (Ubuntu package) - update to 5.4.0-1026.27
linux-image-5.4.0-1028-oracle (Ubuntu package) - update to 5.4.0-1028.29~18.04.1
linux-image-5.4.0-1028-gcp (Ubuntu package) - update to 5.4.0-1028.29~18.04.1
linux-image-5.4.0-1028-aws (Ubuntu package) - update to 5.4.0-1028.29~18.04.1
linux-image-5.4.0-1031-azure (Ubuntu package) - update to 5.4.0-1031.32~18.04.1
Session Smart Router - addressed in versions 5.4.7, 5.5.3
linux-image-oem-20.04 (Ubuntu package) - update to 5.6.0.1048.44
linux-image-5.6.0-1048-oem (Ubuntu package) - update to 5.6.0-1048.52
IBM RackSwitch G7028 - update to 7.6.7.0
IBM RackSwitch G8332 - update to 7.7.35.0
G8264CS_SI_Fabric_Image - update to 7.8.27.0
IBM RackSwitch G8264CS - update to 7.8.27.0
IBM Flex System EN2092 1Gb Ethernet Scalable Switch - update to 7.8.27.0
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch - update to 7.8.27.0
Flex System Fabric EN4093/EN4093R 10Gb Scalable Switch - update to 7.8.27.0
IBM Flex System CN4093 10Gb Converged Scalable Switch - update to 7.8.27.0
IBM RackSwitch G8264T - update to 7.9.29.0
IBM RackSwitch G8316 - update to 7.9.29.0
IBM RackSwitch G8264 - update to 7.11.19.0
IBM RackSwitch G8052 - update to 7.11.19.0
IBM RackSwitch G8124 - update to 7.11.19.0
IBM RackSwitch G8124E - update to 7.11.19.0

External References

Related Security Bulletins