PT-2020-5268 · Linux+3 · Linux Kernel+3
Richard Palethorpe
·
Published
2020-04-01
·
Updated
2022-04-29
·
CVE-2020-11494
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions 3.16 through 5.6.2
Description
An issue in the Linux kernel allows attackers to read uninitialized can frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG INIT STACK ALL. This issue is related to the slc bump function in drivers/net/can/slcan.c. The exploitation of this issue may allow an attacker to gain unauthorized access to protected information.
Recommendations
For Linux kernel versions 3.16 through 5.6.2, consider updating to a version that includes the necessary configuration changes to mitigate this issue, such as enabling CONFIG INIT STACK ALL. As a temporary workaround, consider restricting access to the slc bump function in drivers/net/can/slcan.c to minimize the risk of exploitation.
Fix
Use of Uninitialized Resource
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linux Kernel
Suse
Ubuntu