PT-2024-10826 · Linux · Linux Kernel

Brian-Sy Yang + 4 · Published 2021-04-15 · Updated 2024-04-10 · CVE-2020-36776

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab out-of-bounds issue was found in the Linux kernel, specifically in the thermal/drivers/cpufreq cooling module. This issue is scanned by KASAN in cpu power to freq(). If power is limited below the power of OPP0 in the EM table, it will cause a slab out-of-bound issue with a negative array index. The issue is fixed by returning the lowest frequency if limited power cannot find a suitable OPP in the EM table.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Over-read

Improper Validation of Array Index

Weakness Enumeration

CWE-126

CWE-129

Related Identifiers

BDU:2025-02856

CVE-2020-36776

Affected Products

Linux Kernel

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2020-36776 · Security Note
• https://git.kernel.org/stable/c/6bf443acf6ca4f666d0e4225614ba9993a3aa1a9 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-36776 · Vendor Advisory
• https://git.kernel.org/stable/c/34ab17cc6c2c1ac93d7e5d53bb972df9a968f085 · Patch
• https://git.kernel.org/stable/c/876a5f33e5d961d879c5436987c09b3d9ef70379 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36776 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36776 · Vendor Advisory
• https://git.kernel.org/stable/c/c24a20912eef00587416628149c438e885eb1304 · Patch
• https://ubuntu.com/security/CVE-2020-36776 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36776 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36776 · Security Note
• https://bdu.fstec.ru/vul/2025-02856 · Security Note
• https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.323 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.285 · Note
• https://lore.kernel.org/linux-cve-announce/[e-mail] · Note