CVE-2020-36311: Medium severity Linux Linux kernel vulnerability

Q: What is the severity of CVE-2020-36311?

CVE-2020-36311 has a medium severity rating, as it can lead to a denial of service via a soft lockup.

Q: How do I fix CVE-2020-36311?

To fix CVE-2020-36311, upgrade your Linux kernel to version 5.10.223-1 or later, or to version 6.1.119-1 or later.

Q: Which versions of Linux kernel are affected by CVE-2020-36311?

CVE-2020-36311 affects Linux kernel versions before 5.9.0.

Q: Is Debian affected by CVE-2020-36311?

Yes, Debian GNU/Linux versions 9.0 and 10.0 are affected by CVE-2020-36311.

Q: What is the impact of CVE-2020-36311 on SEV VMs?

The impact of CVE-2020-36311 is a denial of service that can be triggered during the destruction of large SEV VMs.

Published Apr 6, 2021

Updated

An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions), aka CID-7be74942f184.

Affected Software

54 affected componentsFixes available

Linux Linux kernel<5.9.0

Debian Debian Linux=9.0

Debian Debian Linux=10.0

debian/linux

5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-1

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.4<5.4.0-1056.59~18.04.1

5.4.0-1056.59~18.04.1

ubuntu/linux-azure-5.4<5.4.0-1058.60~18.04.1

5.4.0-1058.60~18.04.1

ubuntu/linux-gcp-5.4<5.4.0-1052.56~18.04.1

5.4.0-1052.56~18.04.1

ubuntu/linux-gke-5.4<5.4.0-1052.55~18.04.1

5.4.0-1052.55~18.04.1

ubuntu/linux-gkeop-5.4<5.4.0-1023.24~18.04.1

5.4.0-1023.24~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-84.94~18.04.1

5.4.0-84.94~18.04.1

ubuntu/linux-oracle-5.4<5.4.0-1054.58~18.04.1

5.4.0-1054.58~18.04.1

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-edge*

ubuntu/linux-gke-4.15*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux<5.4.0-84.94

5.4.0-84.94

ubuntu/linux-aws<5.4.0-1056.59

5.4.0-1056.59

ubuntu/linux-azure<5.4.0-1058.60

5.4.0-1058.60

ubuntu/linux-azure-5.8<5.8.0-1043.46~20.04.1

5.8.0-1043.46~20.04.1

ubuntu/linux-bluefield<5.4.0-1019.22

5.4.0-1019.22

ubuntu/linux-gcp<5.4.0-1052.56

5.4.0-1052.56

ubuntu/linux-gke<5.4.0-1052.55

5.4.0-1052.55

ubuntu/linux-gkeop<5.4.0-1023.24

5.4.0-1023.24

ubuntu/linux-kvm<5.4.0-1046.48

5.4.0-1046.48

ubuntu/linux-oracle<5.4.0-1054.58

5.4.0-1054.58

ubuntu/linux-aws-5.8*

ubuntu/linux-gcp-5.8*

ubuntu/linux-hwe-5.8*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.8*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1069.73+fips2

5.4.0-1069.73+fips2

ubuntu/linux-azure-fips<5.4.0-1073.76+fips1

5.4.0-1073.76+fips1

ubuntu/linux-fips<5.4.0-1033.38

5.4.0-1033.38

ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1

5.4.0-1067.71~20.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.59~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1058.60~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1052.56~18.04.1
Upgrade
Upgrade ubuntu/linux-gke-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1052.55~18.04.1
Upgrade
Upgrade ubuntu/linux-gkeop-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1023.24~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-84.94~18.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1054.58~18.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-84.94
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.59
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1058.60
Upgrade
Upgrade ubuntu/linux-azure-5.8 to a version that resolves this vulnerability.
Fixed in 5.8.0-1043.46~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1019.22
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1052.56
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.4.0-1052.55
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1023.24
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1046.48
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1054.58
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73+fips2
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1033.38
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.71~20.04.1
Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Fixed in 5.9

Event History

Apr 6, 2021

CVE Published

via MITRE·11:28 PM

Data Sourced

via MITRE·11:28 PM

Description

Apr 7, 2021

Data Sourced

via OSV·12:15 AM

DescriptionSeverityAffected Software

Data Sourced

via NVD·12:15 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-36311?

CVE-2020-36311 has a medium severity rating, as it can lead to a denial of service via a soft lockup.

How do I fix CVE-2020-36311?

To fix CVE-2020-36311, upgrade your Linux kernel to version 5.10.223-1 or later, or to version 6.1.119-1 or later.

Which versions of Linux kernel are affected by CVE-2020-36311?

CVE-2020-36311 affects Linux kernel versions before 5.9.0.

Is Debian affected by CVE-2020-36311?

Yes, Debian GNU/Linux versions 9.0 and 10.0 are affected by CVE-2020-36311.

What is the impact of CVE-2020-36311 on SEV VMs?

The impact of CVE-2020-36311 is a denial of service that can be triggered during the destruction of large SEV VMs.

CVE-2020-36311: Medium severity Linux Linux kernel vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2020-36311?

How do I fix CVE-2020-36311?

Which versions of Linux kernel are affected by CVE-2020-36311?

Is Debian affected by CVE-2020-36311?

What is the impact of CVE-2020-36311 on SEV VMs?

Company

Resources

Contact