CVE-2020-14314: Medium severity Linux Linux kernel vulnerability
A memory out of bound read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it accesses directory with broken indexing. This flaw allows a local user to crash the system if such directory exists.
Other sources
A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.
A memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.11.1.rt56.1145.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.11.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.rt7.72.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.el8 - Upgrade
Upgrade
redhat/Linux kernel versionto a version that resolves this vulnerability.Fixed in 5.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.12-1Fixed in 7.1.13-1 - Configuration
If directories are broken (broken indexing), run: e2fsck -Df .../partition-name to fix the partition/image directories.
Linux ext3/ext4 (e2fsck) Directory indexing repair using e2fsck -Df = Run command e2fsck -Df .../partition-name - Compensating control
To reduce the impact of a local-user-triggered crash, restrict local user access to the system/partition so untrusted users cannot access a partition/image containing such broken-index directories.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-14314?
CVE-2020-14314 has a medium severity rating due to its ability to cause a system crash under specific conditions.
How do I fix CVE-2020-14314?
To fix CVE-2020-14314, update your Linux kernel to version 5.10.223-1 or later.
What systems are affected by CVE-2020-14314?
CVE-2020-14314 affects various versions of the Linux kernel, specifically those prior to 5.9.
Can CVE-2020-14314 be exploited remotely?
CVE-2020-14314 requires local access to the system to exploit, as it pertains to out-of-bounds memory reads.
What is the nature of the flaw in CVE-2020-14314?
CVE-2020-14314 is a memory out-of-bounds read flaw in the ext3/ext4 file system due to broken directory indexing.