CVE-2019-20636: Input Validation

Published Apr 4, 2020
·
Updated

An out-of-bounds write flaw was found in the Linux kernel. A crafted keycode table could be used by drivers/input/input.c to perform the out-of-bounds write. A local user with root access can insert garbage to this keycode table that can lead to out-of-bounds memory access. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Other sources

In inputdefaultsetkeycode of input.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

— OSV

In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by inputsetkeycode, aka CID-cb222aed03d7.

Affected Software

41 affected componentsFixes available
redhat/kernel-rt<0:3.10.0-1160.rt56.1131.el7
0:3.10.0-1160.rt56.1131.el7
redhat/kernel-alt<0:4.14.0-115.26.1.el7a
0:4.14.0-115.26.1.el7a
redhat/kernel<0:3.10.0-1160.el7
0:3.10.0-1160.el7
redhat/kernel<0:3.10.0-693.81.1.el7
0:3.10.0-693.81.1.el7
redhat/kernel<0:3.10.0-957.65.1.el7
0:3.10.0-957.65.1.el7
redhat/kernel<0:3.10.0-1062.43.1.el7
0:3.10.0-1062.43.1.el7
redhat/kernel-rt<0:4.18.0-240.rt7.54.el8
0:4.18.0-240.rt7.54.el8
redhat/kernel<0:4.18.0-240.el8
0:4.18.0-240.el8
redhat/kernel<5.4.12
5.4.12
Linux Linux kernel<3.16.83
Linux Linux kernel>=3.17<4.4.210
Linux Linux kernel>=4.5<4.9.210
Linux Linux kernel>=4.10<4.14.165
Linux Linux kernel>=4.15<4.19.96
Linux Linux kernel>=4.20<5.4.12
NetApp Cloud Backup
NetApp Solidfire
NetApp Steelstore Cloud Integrated Storage
NetApp Baseboard Management Controller H300s
NetApp Baseboard Management Controller H410s
NetApp Baseboard Management Controller H500s
NetApp Baseboard Management Controller H610c
NetApp Baseboard Management Controller H610s
NetApp Baseboard Management Controller H615c
NetApp Baseboard Management Controller H700s
NetApp Fas 8300
NetApp Fas 8700
NetApp Fas A400
NetApp Fas Baseboard Management Controller A220
NetApp Fas Baseboard Management Controller A320
NetApp Fas Baseboard Management Controller A800
NetApp Fas Baseboard Management Controller C190
NetApp H300s
NetApp H410s
NetApp H500s
NetApp H610c
NetApp H610s
NetApp H615c
NetApp H700s
Google Android
android/:linux_kernel:>=:0<:2020-07-05
:2020-07-05

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1160.rt56.1131.el7
  2. Upgrade

    Upgrade redhat/kernel-alt to a version that resolves this vulnerability.

    Fixed in 0:4.14.0-115.26.1.el7a
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1160.el7
  4. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-693.81.1.el7
  5. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-957.65.1.el7
  6. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1062.43.1.el7
  7. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-240.rt7.54.el8
  8. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-240.el8
  9. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 5.4.12
  10. Upgrade

    Upgrade android/:linux_kernel: to a version that resolves this vulnerability.

    Fixed in :2020-07-05
  11. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Fixed in 5.4.12

Event History

Apr 4, 2020
CVE Published
12:00 AM
Event
12:00 AM
Apr 8, 2020
CVE Published
via MITRE·01:58 PM
Data Sourced
via MITRE·01:58 PM
Description
Jul 1, 2020
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software
Jul 6, 2020
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is CVE-2019-20636?

CVE-2019-20636 is an out-of-bounds write vulnerability in the Linux kernel.

2

How does CVE-2019-20636 work?

CVE-2019-20636 allows a local user with root access to insert garbage to the keycode table and perform an out-of-bounds write, leading to potential memory access issues.

3

What is the severity of CVE-2019-20636?

CVE-2019-20636 has a severity score of 6.7, indicating a high severity.

4

Which versions of the Linux kernel are affected by CVE-2019-20636?

The Linux kernel versions before 5.4.12 are affected by CVE-2019-20636.

5

How can I fix CVE-2019-20636?

To fix CVE-2019-20636, update your Linux kernel to version 5.4.12 or higher.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203