CVE-2020-14314: Medium severity Linux Linux kernel vulnerability
A memory out of bound read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it accesses directory with broken indexing. This flaw allows a local user to crash the system if such directory exists.
Other sources
A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.
A memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.11.1.rt56.1145.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.11.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.rt7.72.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.el8 - Upgrade
Upgrade
redhat/Linux kernel versionto a version that resolves this vulnerability.Fixed in 5.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Compensating control
Run e2fsck with the -Df option on the affected ext3/ext4 partition or image to fix directories with broken indexing that can trigger the out-of-bounds read (e.g., e2fsck -Df .../partition-name).
- Operational
If you expect directories might be broken already, schedule/execute the e2fsck -Df .../partition-name repair before continuing normal operation to reduce the risk of local users crashing the system.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-14314?
CVE-2020-14314 has a medium severity rating due to its ability to cause a system crash under specific conditions.
How do I fix CVE-2020-14314?
To fix CVE-2020-14314, update your Linux kernel to version 5.10.223-1 or later.
What systems are affected by CVE-2020-14314?
CVE-2020-14314 affects various versions of the Linux kernel, specifically those prior to 5.9.
Can CVE-2020-14314 be exploited remotely?
CVE-2020-14314 requires local access to the system to exploit, as it pertains to out-of-bounds memory reads.
What is the nature of the flaw in CVE-2020-14314?
CVE-2020-14314 is a memory out-of-bounds read flaw in the ext3/ext4 file system due to broken directory indexing.