CVE-2020-11494CWE-908CWE-909

CVE-2020-11494

Medium · published April 3, 2020

CVSS v3.1
4.4
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka CID-b9258a2cece4.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00722 · 53.4th percentile
Weaknesses
CWE-908 · Use of Uninitialized Resource; CWE-909 · Missing Initialization of Resource
Published
2020-04-03T01:15Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 3.16, ≤ 5.6.2—
opensuse/leapall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
References (26)
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html · [email protected]http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html · [email protected]https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=08fadc32ce6239dc75fd5e869590e29bc62bbc28 · [email protected]https://github.com/torvalds/linux/commit/b9258a2cece4ec1f020715fe3554bc2e360f6264 · [email protected]https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html · [email protected]https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html · [email protected]https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html · [email protected]https://security.netapp.com/advisory/ntap-20200430-0004/ · [email protected]https://usn.ubuntu.com/4363-1/ · [email protected]https://usn.ubuntu.com/4364-1/ · [email protected]https://usn.ubuntu.com/4368-1/ · [email protected]https://usn.ubuntu.com/4369-1/ · [email protected]https://www.debian.org/security/2020/dsa-4698 · [email protected]http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=08fadc32ce6239dc75fd5e869590e29bc62bbc28 · af854a3a-2127-422b-91ae-364da2661108https://github.com/torvalds/linux/commit/b9258a2cece4ec1f020715fe3554bc2e360f6264 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200430-0004/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4363-1/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4364-1/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4368-1/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4369-1/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4698 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 02 APR 20:14Z
    An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2
    cvelistv5