CVE-2020-27830: Null Pointer Dereference

Q: What is the severity of CVE-2020-27830?

CVE-2020-27830 has been classified as a medium severity vulnerability due to its potential to cause application crashes.

Q: How do I fix CVE-2020-27830?

To fix CVE-2020-27830, update your Linux Kernel to version 5.9.14 or later for Red Hat systems, or to the specific patched versions for Debian as listed.

Q: What systems are affected by CVE-2020-27830?

CVE-2020-27830 affects versions of the Linux Kernel prior to 5.9.14 and specific versions of Debian GNU/Linux.

Q: What is the nature of the vulnerability described in CVE-2020-27830?

CVE-2020-27830 is a NULL pointer dereference vulnerability that may lead to system crashes in certain conditions.

Q: Is there a workaround for CVE-2020-27830?

There is no established workaround for CVE-2020-27830 other than upgrading the software to a patched version.

Published Jan 25, 2021

Updated

A vulnerability was found in Linux Kernel where in the spkttyioreceivebuf2() function, it would dereference spkttyiosynth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.

Other sources

A vulnerability was found in Linux Kernel, where in the spkttyioreceivebuf2() function, it would dereference spkttyiosynth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.

References: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git/commit/?h=char-misc-linus&id=f0992098cadb4c9c6a00703b66cafe604e178fea

— Red Hat

Affected Software

74 affected componentsFixes available

redhat/kernel<5.9.14

5.9.14

Linux Linux kernel<5.9.14

Debian Debian Linux=9.0

Debian Debian Linux=10.0

debian/linux

5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-16.12.27-1

ubuntu/linux-azure<4.15.0-1108.120~14.04.1

4.15.0-1108.120~14.04.1

ubuntu/linux-aws-hwe<4.15.0-1094.101~16.04.1

4.15.0-1094.101~16.04.1

ubuntu/linux-azure<4.15.0-1108.120~16.04.1

4.15.0-1108.120~16.04.1

ubuntu/linux-gcp<4.15.0-1093.106~16.04.1

4.15.0-1093.106~16.04.1

ubuntu/linux-hwe<4.15.0-136.140~16.04.1

4.15.0-136.140~16.04.1

ubuntu/linux-oracle<4.15.0-1065.73~16.04.1

4.15.0-1065.73~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux<4.15.0-136.140

4.15.0-136.140

ubuntu/linux-aws<4.15.0-1094.101

4.15.0-1094.101

ubuntu/linux-aws-5.4<5.4.0-1038.40~18.04.1

5.4.0-1038.40~18.04.1

ubuntu/linux-azure-4.15<4.15.0-1108.120

4.15.0-1108.120

ubuntu/linux-azure-5.4<5.4.0-1040.42~18.04.1

5.4.0-1040.42~18.04.1

ubuntu/linux-dell300x<4.15.0-1012.16

4.15.0-1012.16

ubuntu/linux-gcp-4.15<4.15.0-1093.106

4.15.0-1093.106

ubuntu/linux-gcp-5.4<5.4.0-1037.40~18.04.1

5.4.0-1037.40~18.04.1

ubuntu/linux-gke-4.15<4.15.0-1079.84

4.15.0-1079.84

ubuntu/linux-gke-5.4<5.4.0-1036.38~18.04.1

5.4.0-1036.38~18.04.1

ubuntu/linux-gkeop-5.4<5.4.0-1010.11~18.04.1

5.4.0-1010.11~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-66.74~18.04.2

5.4.0-66.74~18.04.2

ubuntu/linux-kvm<4.15.0-1085.87

4.15.0-1085.87

ubuntu/linux-oracle<4.15.0-1065.73

4.15.0-1065.73

ubuntu/linux-oracle-5.4<5.4.0-1038.41~18.04.1

5.4.0-1038.41~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1029.32~18.04.1

5.4.0-1029.32~18.04.1

ubuntu/linux-raspi2<4.15.0-1079.84

4.15.0-1079.84

ubuntu/linux-snapdragon<4.15.0-1096.105

4.15.0-1096.105

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-edge*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2037.39

4.15.0-2037.39

ubuntu/linux-azure-fips<4.15.0-2020.23

4.15.0-2020.23

ubuntu/linux-fips<4.15.0-1053.61

4.15.0-1053.61

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-66.74

5.4.0-66.74

ubuntu/linux-aws<5.4.0-1038.40

5.4.0-1038.40

ubuntu/linux-azure<5.4.0-1040.42

5.4.0-1040.42

ubuntu/linux-gcp<5.4.0-1037.40

5.4.0-1037.40

ubuntu/linux-gke<5.4.0-1036.38

5.4.0-1036.38

ubuntu/linux-gkeop<5.4.0-1010.11

5.4.0-1010.11

ubuntu/linux-hwe-5.8<5.8.0-44.50~20.04.1

5.8.0-44.50~20.04.1

ubuntu/linux-kvm<5.4.0-1033.34

5.4.0-1033.34

ubuntu/linux-oem-5.6<5.6.0-1053.57

5.6.0-1053.57

ubuntu/linux-oracle<5.4.0-1038.41

5.4.0-1038.41

ubuntu/linux-raspi<5.4.0-1029.32

5.4.0-1029.32

ubuntu/linux-riscv-5.8<5.8.0-17.19~20.04.1

5.8.0-17.19~20.04.1

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-aws-fips<5.4.0-1069.73+fips2

5.4.0-1069.73+fips2

ubuntu/linux-azure-fips<5.4.0-1073.76+fips1

5.4.0-1073.76+fips1

ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1

5.4.0-1067.71~20.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 5.9.14
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1108.120~14.04.1
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1094.101~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1108.120~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1093.106~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-136.140~16.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1065.73~16.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-136.140
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1094.101
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1038.40~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1108.120
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1040.42~18.04.1
Upgrade
Upgrade ubuntu/linux-dell300x to a version that resolves this vulnerability.
Fixed in 4.15.0-1012.16
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1093.106
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1037.40~18.04.1
Upgrade
Upgrade ubuntu/linux-gke-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1079.84
Upgrade
Upgrade ubuntu/linux-gke-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1036.38~18.04.1
Upgrade
Upgrade ubuntu/linux-gkeop-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1010.11~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-66.74~18.04.2
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1085.87
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1065.73
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1038.41~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1029.32~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.
Fixed in 4.15.0-1079.84
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.15.0-1096.105
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2037.39
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2020.23
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1053.61
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-66.74
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1038.40
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1040.42
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1037.40
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.4.0-1036.38
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1010.11
Upgrade
Upgrade ubuntu/linux-hwe-5.8 to a version that resolves this vulnerability.
Fixed in 5.8.0-44.50~20.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1033.34
Upgrade
Upgrade ubuntu/linux-oem-5.6 to a version that resolves this vulnerability.
Fixed in 5.6.0-1053.57
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1038.41
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1029.32
Upgrade
Upgrade ubuntu/linux-riscv-5.8 to a version that resolves this vulnerability.
Fixed in 5.8.0-17.19~20.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73+fips2
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.71~20.04.1

Event History

Dec 7, 2020

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

May 13, 2021

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-27830?

CVE-2020-27830 has been classified as a medium severity vulnerability due to its potential to cause application crashes.

How do I fix CVE-2020-27830?