CVE-2020-35519: High severity linux kernel vulnerability
An out-of-bounds (OOB) memory access flaw was found in x25bind in net/x25/afx25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system's integrity and availability.
As .x25addr[] array comes from the user and is not necessarily NUL terminated. Using strnlen() instead of strlen() will prevent a read overflow problem.
Other sources
An out-of-bounds (OOB) memory access flaw was found in x25bind in net/x25/afx25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-35519?
CVE-2020-35519 is considered to have a high severity due to the potential for an attacker to exploit the out-of-bounds memory access flaw.
How do I fix CVE-2020-35519?
To fix CVE-2020-35519, you should upgrade to a patched version of the Linux kernel, specifically versions 5.10.223, 5.10.226, or later.
What products are affected by CVE-2020-35519?
CVE-2020-35519 affects multiple versions of the Linux kernel ranging from versions 2.6.12 to 5.9.13.
Can CVE-2020-35519 lead to system crashes?
Yes, CVE-2020-35519 can lead to system crashes or even a leak of internal kernel information.
Is there a workaround for CVE-2020-35519?
As a temporary measure, limiting user access and minimizing the number of local users can reduce the risk of exploitation until the vulnerability is patched.