kernel: possible out-of-bounds read in skb_headlen of /include/linux/skbuff.h
Published Sep 17, 2020
7.8
HIGHCVSS 3.1
EPSS 0.18%
Description
In skb_headlen of /include/linux/skbuff.h, there is a possible out of bounds read due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-153881554
Affected products
- Vendor n/a Product Android Defaultn/a
- Version Android kernelStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Android | n/a |
|
No data.
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-alt
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Not affected
Red Hat Enterprise Linux 9
kernel
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-alt | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space. For the Red Hat Enterprise Linux 7 the eBPF for unprivileged users is always disabled. For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command: # cat /proc/sys/kernel/unprivileged_bpf_disabled The setting of 1 would mean that unprivileged users can not use eBPF.
References (7)
- https://access.redhat.com/security/cve/CVE-2020-0430 Vendor Advisory
- https://android.googlesource.com/kernel/common/+/7fed98f4%5E%21/#F0
- https://bugzilla.redhat.com/show_bug.cgi?id=2003224 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-1932 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-0430
- https://source.android.com/security/bulletin/pixel/2020-09-01 x_refsource_MISCVendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-0430
Change history (0)
No recorded changes yet.