CVE-2020-14386: High severity Linux Linux kernel vulnerability
A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
A flaw was found in the Linux kernel. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A vulnerability was found in Linux Kernel, which leads to a memory corruption in (net/packet/afpacket.c). It can be exploited to gain root privileges from unprivileged processes.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.28.1.rt13.77.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.28.1.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-80.31.1.el8_0 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.32.1.el8_1 - Upgrade
Upgrade
redhat/Linux kernelto a version that resolves this vulnerability.Fixed in 5.9 - Configuration
Disable the CAP_NET_RAW capability for regular (unprivileged) users and for executables so unprivileged processes cannot gain raw network access.
Linux capabilities (CAP_NET_RAW) CAP_NET_RAW for unprivileged users/executables = disabled - Configuration
Disable unprivileged user namespaces by creating /etc/sysctl.d/userns.conf with 'user.max_user_namespaces=0' and load it: echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf; sysctl -p /etc/sysctl.d/userns.conf
sysctl (user.max_user_namespaces) user.max_user_namespaces = 0 - Configuration
Remove CAP_NET_RAW from the default cri-o capabilities provided to pods by creating a MachineConfig that resets CRI-O capabilities (apply the provided MachineConfig example) and apply it (e.g. oc apply). Note: this may prevent ping in unprivileged pods and has only been validated for OpenShift 4.4/4.5.
OpenShift/CRI-O default capabilities default_capabilities = remove CAP_NET_RAW - Operational
Monitor the rollout of the OpenShift MachineConfig change (e.g. oc describe machineconfigpool/worker) and check for pods that start to crash; adjust pod securityContext/capabilities to explicitly request CAP_NET_RAW where required.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-14386.
What is the severity of CVE-2020-14386?
The severity of CVE-2020-14386 is high.
How does CVE-2020-14386 affect the Linux kernel?
CVE-2020-14386 affects the Linux kernel before version 5.9-rc4.
How can memory corruption be exploited in CVE-2020-14386?
Memory corruption in CVE-2020-14386 can be exploited to gain root privileges from unprivileged processes.
What are the potential impacts of CVE-2020-14386?
The highest threat from CVE-2020-14386 is to data confidentiality and integrity as well as system availability.
How can I fix CVE-2020-14386?
To fix CVE-2020-14386, update the Linux kernel to version 5.9-rc4 or later.