CVE-2020-11565: Medium severity Linux Linux kernel vulnerability
DISPUTED An issue was discovered in the Linux kernel through 5.6.2. mpolparsestr in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only be specified by a privileged user, so triggering the bug does not grant any powers not already held.”.
Other sources
An issue was discovered in the Linux kernel through 5.6.2. mpolparsestr in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing.
Reference and upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd
— Red Hat
An out-of-bounds write flaw was found in the Linux kernel. An empty nodelist in mempolicy.c is mishandled durig mount option parsing leading to a stack-based out-of-bounds write. The highest threat from this vulnerability is to system availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.26.1.el7a - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.rt7.54.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-11565?
CVE-2020-11565 has been reported as a disputed vulnerability with a potential for stack-based out-of-bounds writes.
How do I fix CVE-2020-11565?
To fix CVE-2020-11565, update your kernel to one that has removed the vulnerability, such as kernel version 5.10.223-1 or later.
Which Linux distributions are affected by CVE-2020-11565?
CVE-2020-11565 affects multiple Linux distributions, including several versions of Ubuntu and Red Hat.
What versions of the kernel are vulnerable to CVE-2020-11565?
The vulnerability CVE-2020-11565 affects Linux kernel versions up to and including 5.6.2.
Is CVE-2020-11565 exploitable?
Exploitation of CVE-2020-11565 may lead to arbitrary code execution due to stack corruption, although the exact risk may vary based on configurations.