CVE-2020-0404
First published: Tue Sep 08 2020(Updated: )
A flaw linked list corruption in the Linux kernel for USB Video Class driver functionality was found in the way user connects web camera to the USB port. A local user could use this flaw to crash the system.
Credit: security@android.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-372.9.1.rt7.166.el8 | 0:4.18.0-372.9.1.rt7.166.el8 |
| redhat/kernel | <0:4.18.0-372.9.1.el8 | 0:4.18.0-372.9.1.el8 |
| Google Android | ||
| Oracle Communications Cloud Native Core Binding Support Function | =22.1.3 | |
| Oracle Communications Cloud Native Core Network Exposure Function | =22.1.1 | |
| Oracle Communications Cloud Native Core Policy | =22.2.0 | |
| Google Android |
Remedy
To mitigate this issue, prevent the module uvcvideo from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://android.googlesource.com/kernel/common/+/68035c80e129
- https://source.android.com/docs/security/bulletin/2020-09-01 (Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html
- https://source.android.com/security/bulletin/2020-09-01
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=68035c80e129c4cfec659aac4180354530b26527
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1919792
- https://access.redhat.com/solutions/41278
- https://access.redhat.com/errata/RHSA-2022:1975
- https://access.redhat.com/errata/RHSA-2022:1988
- https://access.redhat.com/security/cve/cve-2020-0404
- https://bugzilla.redhat.com/show_bug.cgi?id=1919791
- https://www.cve.org/CVERecord?id=CVE-2020-0404 https://nvd.nist.gov/vuln/detail/CVE-2020-0404 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=68035c80e129c4cfec659aac4180354530b26527
Frequently Asked Questions
What is CVE-2020-0404?
CVE-2020-0404 is a high severity vulnerability in the Linux kernel for USB Video Class driver functionality.
How does CVE-2020-0404 impact affected software?
CVE-2020-0404 can lead to local escalation of privilege in the kernel with no additional execution privileges needed.
Is user interaction required for exploitation of CVE-2020-0404?
No, user interaction is not needed for exploitation of CVE-2020-0404.
How can I fix CVE-2020-0404?
To fix CVE-2020-0404, update the affected software to versions 4.18.0-372.9.1.rt7.166.el8 for kernel-rt or 4.18.0-372.9.1.el8 for kernel.
Where can I find more information about CVE-2020-0404?
You can find more information about CVE-2020-0404 at the following references: - [Commit on Git Kernel](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=68035c80e129c4cfec659aac4180354530b26527) - [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1919792) - [Red Hat Access Solution](https://access.redhat.com/solutions/41278)
- collector/redhat-cve
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-0404
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/remedy
- agent/severity
- agent/weakness
- agent/author
- collector/android-source
- source/Android
- agent/software-canonical-lookup
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- package-manager/redhat
- vendor/google
- canonical/google android
- vendor/oracle
- canonical/oracle communications cloud native core binding support function
- version/oracle communications cloud native core binding support function/22.1.3
- canonical/oracle communications cloud native core network exposure function
- version/oracle communications cloud native core network exposure function/22.1.1
- canonical/oracle communications cloud native core policy
- version/oracle communications cloud native core policy/22.2.0