CVE-2020-14305: High severity Linux Linux kernel vulnerability

Published Jun 9, 2020
·
Updated

A flaw memory corruption in the Linux kernel Voice over IP h323-conntrack-nat module was found. An attacker could use this flaw to corrupt the memory. For reproducing, need to establish connection to the port 1720 that is being used during call setup negotiation. For ipv4 no crash (kernel panic), so for detecting corruption need to use ipv6. The corruption happens for fields of struct nfctext (usually nfctnat is located after nfconnhelp, but possibly nfconnnat and other that located in memory right after nfconnhelp). In most cases the overlapping bytes were zero (if without debug options), so attacker cannot control directly what is being written to the corrupted memory, but at least one numerical value could be modified with tpktlen (so attacker can change TCP/IP packet payload size to control what is being written to some corrupted Int value).

The patch is: https://patchwork.ozlabs.org/project/netfilter-devel/patch/c2385b5c-309c-cc64-2e10-a0ef62897502@virtuozzo.com/

Other sources

An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

In nfconntrackhelperq931 of nfconntrackh323main.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation.

— OSV

Affected Software

47 affected componentsFixes available
redhat/kernel-rt<0:3.10.0-1160.rt56.1131.el7
0:3.10.0-1160.rt56.1131.el7
redhat/kernel<0:3.10.0-1160.el7
0:3.10.0-1160.el7
redhat/kernel<4.12
4.12
Linux Linux kernel<=4.11.12
Linux Linux kernel=4.12
NetApp Cloud Backup
NetApp A250 Firmware
NetApp A250
NetApp Fas 500f Firmware
NetApp Fas 500f
NetApp Aff 500f Firmware
NetApp Aff 500f
NetApp Solidfire Baseboard Management Controller Firmware
NetApp Solidfire Baseboard Management Controller
Google Android
android/:linux_kernel:>=:0<:2021-06-05
:2021-06-05
ubuntu/linux-aws<4.4.0-1076.80
4.4.0-1076.80
ubuntu/linux-lts-xenial<4.4.0-187.217~14.04.1
4.4.0-187.217~14.04.1
ubuntu/linux*
ubuntu/linux<4.4.0-187.217
4.4.0-187.217
ubuntu/linux-aws<4.4.0-1112.124
4.4.0-1112.124
ubuntu/linux-azure<4.13.0-1005.7
4.13.0-1005.7
ubuntu/linux-gcp<4.13.0-1002.5
4.13.0-1002.5
ubuntu/linux-hwe<4.13.0-32.35~16.04.1
4.13.0-32.35~16.04.1
ubuntu/linux-kvm<4.4.0-1078.85
4.4.0-1078.85
ubuntu/linux-raspi2<4.4.0-1137.146
4.4.0-1137.146
ubuntu/linux-snapdragon<4.4.0-1141.149
4.4.0-1141.149
ubuntu/linux-hwe-edge*
ubuntu/linux-fips<4.4.0-1044.49
4.4.0-1044.49
ubuntu/linux-fips*
ubuntu/linux-snapdragon<4.15.0-1053.57
4.15.0-1053.57
ubuntu/linux-aws-5.0*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-edge*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-azure-fde*
ubuntu/linux-gke*
ubuntu/linux-raspi2*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1160.rt56.1131.el7
  2. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1160.el7
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 4.12
  4. Upgrade

    Upgrade android/:linux_kernel: to a version that resolves this vulnerability.

    Fixed in :2021-06-05
  5. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1076.80
  6. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-187.217~14.04.1
  7. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-187.217
  8. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1112.124
  9. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.13.0-1005.7
  10. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.13.0-1002.5
  11. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.13.0-32.35~16.04.1
  12. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1078.85
  13. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.4.0-1137.146
  14. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.4.0-1141.149
  15. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1044.49
  16. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.15.0-1053.57
  17. Configuration

    Blacklist the nf_conntrack_h323 kernel module to prevent it from loading.

    nf_conntrack_h323 module blacklist = blacklisted
  18. Compensating control

    Do not use IPv6 on affected hardware until the Linux kernel has been updated.

  19. Operational

    Unload the nf_conntrack_h323 kernel module from systems where it is currently loaded.

Event History

Jun 9, 2020
CVE Published
12:00 AM
Dec 2, 2020
CVE Published
via MITRE·12:48 AM
Data Sourced
via MITRE·12:48 AM
DescriptionWeakness
Data Sourced
via OSV·01:15 AM
DescriptionSeverityAffected Software
Jun 1, 2021
Advisory Published
via OSV·12:00 AM
Jun 7, 2021
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2020-14305?

The severity of CVE-2020-14305 is high as it allows an unauthenticated remote user to crash the system, leading to a denial of service.

2

How do I fix CVE-2020-14305?

To fix CVE-2020-14305, upgrade to the patched versions of the Linux kernel provided by your distribution, such as kernel-rt version 0:3.10.0-1160.rt56.1131.el7 or kernel version 0:3.10.0-1160.el7.

3

What type of vulnerability is CVE-2020-14305?

CVE-2020-14305 is an out-of-bounds memory write flaw in the Linux kernel’s Voice Over IP H.323 connection tracking functionality.

4

Which systems are affected by CVE-2020-14305?

CVE-2020-14305 affects various versions of the Linux kernel, including certain versions of the Red Hat kernel and the Linux kernel up to 4.11.12.

5

Can CVE-2020-14305 be exploited remotely?

Yes, CVE-2020-14305 can be exploited by an unauthenticated remote user, potentially leading to a system crash.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203