CVE-2020-11609: Null Pointer Dereference
An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xxpb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2020-11609?
CVE-2020-11609 is a medium-severity vulnerability due to possible NULL pointer dereference.
How do I fix CVE-2020-11609?
To fix CVE-2020-11609, update the Linux kernel to version 5.6.1 or higher.
Which systems are affected by CVE-2020-11609?
CVE-2020-11609 affects Linux kernel versions before 5.6.1 and Ubuntu Linux versions 16.04 and 18.04.
What type of vulnerability is CVE-2020-11609?
CVE-2020-11609 is a mishandling of invalid descriptors in the stv06xx subsystem.
How was CVE-2020-11609 discovered?
CVE-2020-11609 was discovered due to specific issues in the drivers/media/usb/gspca/stv06xx code.