Buffer overflow in Linux Kernel
CVE-2020-11565
An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only be specified by a privileged user, so triggering the bug does not grant any powers not already held.”
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (41.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 41.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Linux Kernel
- Canonical Ubuntu Linux — versions 14.04, 16.04, 18.04
Weakness classification (CWE)
References
- github.com/torvalds/linux/commit/aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd (Patch, Third Party Advisory)
- git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/ (Patch, Mailing List, Vendor Advisory)
- www.debian.org/security/2020/dsa-4667 (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/4364-1/ (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/4367-1/ (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/4368-1/ (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/4363-1/ (vendor-advisory)
- usn.ubuntu.com/4369-1/ (vendor-advisory)
- lists.debian.org/debian-lts-announce/2020/06/msg00011.html (mailing-list)
- lists.debian.org/debian-lts-announce/2020/06/msg00012.html (mailing-list)
Frequently asked questions
- What is CVE-2020-11565?
- CVE-2020-11565 is a medium-severity vulnerability in Linux Kernel, classified under Out-of-bounds Write. CVSS score: 6.0/10. Published 2020-04-06.
- How severe is CVE-2020-11565?
- Medium severity. CVSS v3 base score is 6.0 out of 10.