PT-2020-2221 · Linux+6 · Linux Kernel+6

Published 2020-01-03 · Updated 2021-07-22 · CVE-2020-11668

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.6.1

Description The issue is related to the Xirlink camera USB driver in the Linux kernel, which mishandles invalid descriptors. This can be exploited to impact the integrity of protected information and cause a denial of service. The vulnerability is associated with pointer dereference errors.

Recommendations For Linux kernel versions prior to 5.6.1, update to version 5.6.1 or later to resolve the issue. As a temporary workaround, consider disabling the Xirlink camera USB driver until a patch is available. Restrict access to the vulnerable driver to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2020:4431

ALT-PU-2020-1671

ALT-PU-2020-1673

ALT-PU-2020-1761

ALT-PU-2020-1917

ALT-PU-2020-2153

ALT-PU-2020-2164

ALT-PU-2021-1621

ALT-PU-2021-1656

ALT-PU-2021-1739

ALT-PU-2021-1862

ALT-PU-2021-1866

ALT-PU-2021-1870

BDU:2020-02136

CESA-2020_4431

CESA-2020_4609

CESA-2021_2725

CVE-2020-11668

DLA-2241-1

DLA-2241-2

DLA-2242-1

DSA-4698-1

MGASA-2020-0183

MGASA-2020-0184

OPENSUSE-SU-2021:0060-1

OPENSUSE-SU-2021:0075-1

OPENSUSE-SU-2021:0242-1

OPENSUSE-SU-2021_0060-1

OPENSUSE-SU-2021_0075-1

OPENSUSE-SU-2021_0242-1

RHSA-2020:4431

RHSA-2020:4609

RHSA-2020_4431

RHSA-2020_4609

RHSA-2021:2725

RHSA-2021:2726

RHSA-2021_2725

RHSA-2021_2726

SUSE-SU-2020:2491-1

SUSE-SU-2020:2492-1

SUSE-SU-2020:2497-1

SUSE-SU-2020:2498-1

SUSE-SU-2020:2499-1

SUSE-SU-2020:2502-1

SUSE-SU-2020:2505-1

SUSE-SU-2020:2506-1

SUSE-SU-2020:2507-1

SUSE-SU-2020:2513-1

SUSE-SU-2020:2524-1

SUSE-SU-2020:2525-1

SUSE-SU-2020:2526-1

SUSE-SU-2020:2531-1

SUSE-SU-2020:3178-1

SUSE-SU-2020:3219-1

SUSE-SU-2020:3648-1

SUSE-SU-2020:3656-1

SUSE-SU-2020:3705-1

SUSE-SU-2020_2525-1

SUSE-SU-2020_3705-1

SUSE-SU-2021:0096-1

SUSE-SU-2021:0097-1

SUSE-SU-2021:0108-1

SUSE-SU-2021:0117-1

SUSE-SU-2021:0437-1

SUSE-SU-2021:0438-1

SUSE-SU-2021:0452-1

SUSE-SU-2021:14630-1

SUSE-SU-2021_14630-1

USN-4345-1

USN-4364-1

USN-4368-1

USN-4369-1

Affected Products

Alt Linux

Almalinux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 1161

• https://github.com/torvalds/linux/commit/a246b4d547708f33ff4d4b9a7a5dbac741dc89d8 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0096-1 · Vendor Advisory
• https://debian.org/security/2020/dsa-4698 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3705-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4368-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-9383 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4431.html · Vendor Advisory
• https://usn.ubuntu.com/4364-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2525-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2507-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4345-1 · Vendor Advisory
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a246b4d547708f33ff4d4b9a7a5dbac741dc89d8 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11668 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0184 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2524-1 · Vendor Advisory