CVE-2020-12655

kernel: sync of excessive duration via an XFS v5 image with crafted metadata

An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2020-12654

kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in drivers/net/wireless/marvell/mwifiex/wmm.c

An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.

CVSS 3.1 · 7.1 High EPSS 1.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 5 more

CVE-2020-12653

kernel: buffer overflow in mwifiex_cmd_append_vsie_tlv function in drivers/net/wireless/marvell/mwifiex/scan.c

An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp and 2 more

Products

Debian Linux Linux Kernel A700s and 39 more

CVE-2020-12465

kernel: buffer overflow in mt76_add_fragment function in drivers/net/wireless/mediatek/mt76/dma.c

An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Active Iq Unified Manager Aff Baseboard Management Controller and 7 more

CVE-2020-12464

kernel: use-after-free in usb_sg_cancel function in drivers/usb/core/message.c

usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Active Iq Unified Manager Aff A700s and 8 more

CVE-2020-12364

kernel: Null pointer dereference in some Intel(R) Graphics Drivers

Null pointer reference in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before version Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Intel Linux Redhat

Products

Graphics Drivers Linux Kernel Enterprise Linux and 1 more

CVE-2020-12363

kernel: Improper input validation in some Intel(R) Graphics Drivers

Improper input validation in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Intel Linux Redhat

Products

Graphics Drivers Linux Kernel Enterprise Linux and 1 more

CVE-2020-12362

kernel: Integer overflow in Intel(R) Graphics Drivers

Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Intel Linux Redhat

Products

Graphics Drivers Linux Kernel Enterprise Linux and 6 more

CVE-2020-12352

kernel: net: bluetooth: information leak when processing certain AMP packets

Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.

CVSS 3.1 · 6.5 Medium EPSS 5.8% KEV · Not listed

Vendors

Bluez Linux Redhat

Products

Bluez Linux Kernel Enterprise Linux and 5 more

CVE-2020-12351

kernel: net: bluetooth: type confusion while processing AMP packets

Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

CVSS 3.1 · 8.8 High EPSS 7.8% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Aus and 4 more

CVE-2020-12114

kernel: DoS by corrupting mountpoint reference counter

A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a denial of service (panic) by corrupting a mountpoint reference counter.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus

CVE-2020-11884

Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation

In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 35 more

CVE-2020-11669

kernel: powerpc: guest can cause DoS on POWER9 KVM hosts

An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Opensuse Redhat

Products

Linux Kernel Leap Enterprise Linux

CVE-2020-11668

kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c

In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Extras Rt

CVE-2020-11608

kernel: NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs in drivers/media/usb/gspca/ov519.c

An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Linux

CVE-2020-11565

kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c

An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only be specified by a privileged user, so triggering the bug does not grant any powers not already held.”

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Linux and 1 more

CVE-2020-10942

kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field

In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 3 more

CVE-2020-10933

ruby: BasicSocket#read_nonblock method leads to information disclosure

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 5 more

CVE-2020-10774

kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features

A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/kernel/rh_features file. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2020-10773

kernel: kernel stack information leak on s390/s390x

A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This flaw allows a local user to see the kernel data.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux