CVE-2020-14356

moderate-risk
Published 2020-08-19

A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.

Do I need to act?

-
0.77% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (14)

Affected Vendors

Debian Redhat Linux Canonical Netapp Opensuse

References (24)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
Exploit https://bugzilla.kernel.org/show_bug.cgi?id=208003
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1868453
Mailing List https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
Mailing List https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
Mailing List https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
Exploit https://lore.kernel.org/netdev/CAM_iQpUKQJrj8wE+Qa8NGR3P0L+5Uz=qo-O5+k_P60HzTde6...
Third Party Advisory https://security.netapp.com/advisory/ntap-20200904-0002/
Third Party Advisory https://usn.ubuntu.com/4483-1/
Third Party Advisory https://usn.ubuntu.com/4484-1/
Third Party Advisory https://usn.ubuntu.com/4526-1/
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
Exploit https://bugzilla.kernel.org/show_bug.cgi?id=208003
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1868453
Mailing List https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
Mailing List https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
Mailing List https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
Exploit https://lore.kernel.org/netdev/CAM_iQpUKQJrj8wE+Qa8NGR3P0L+5Uz=qo-O5+k_P60HzTde6...
and 4 more references
45
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 3/34 · Minimal
Exposure 18/34 · Moderate