CVE-2020-36322: Medium severity linux kernel vulnerability

Published Dec 10, 2020
·
Updated

A denial of service flaw was found in fusedogetattr in fs/fuse/dir.c in the kernel side of the FUSE filesystem in the Linux kernel. A local user could use this flaw to crash the system.

Other sources

An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. fusedogetattr() calls makebadinode() in inappropriate situations, causing a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950.

An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6. fusedogetattr() calls makebadinode() in inappropriate situations, causing a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950.

Reference and upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454

Red Hat

Affected Software

11 affected componentsFixes available
redhat/kernel-rt<0:3.10.0-1160.53.1.rt56.1193.el7
0:3.10.0-1160.53.1.rt56.1193.el7
redhat/kernel<0:3.10.0-1160.53.1.el7
0:3.10.0-1160.53.1.el7
redhat/kernel<0:4.18.0-305.el8
0:4.18.0-305.el8
redhat/kernel-rt<0:4.18.0-193.71.1.rt13.121.el8_2
0:4.18.0-193.71.1.rt13.121.el8_2
redhat/kernel<0:4.18.0-193.71.1.el8_2
0:4.18.0-193.71.1.el8_2
redhat/Linux kernel<5.11
5.11
Linux Linux kernel<5.10.6
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Starwindsoftware Starwind Virtual San=8-14338
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-16.12.27-1

Remediation

Information

As the FUSE module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions: # echo "install fuse /bin/true" >> /etc/modprobe.d/disable-fuse.conf The system will need to be restarted if the FUSE modules are loaded. In most circumstances, the CIFS kernel modules will be unable to be unloaded while the FUSE filesystems are in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

Event History

Dec 10, 2020
CVE Published
12:00 AM
Apr 14, 2021
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Jan 11, 2024
Data Sourced
via Launchpad·11:51 PM
Description
Apr 28, 2025
Data Sourced
via Ubuntu·03:46 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·03:47 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2020-36322?

CVE-2020-36322 has been classified as a denial of service vulnerability that can lead to system crashes.

2

How do I fix CVE-2020-36322?

To fix CVE-2020-36322, update the Linux kernel to versions 5.10.6 or later, or apply the relevant patches for your distribution.

3

Which versions of Linux are affected by CVE-2020-36322?

CVE-2020-36322 affects Linux kernel versions prior to 5.10.6, including specific versions of Red Hat and Debian kernels.

4

Can a local user exploit CVE-2020-36322?

Yes, a local user can exploit CVE-2020-36322 to crash the system and cause a denial of service.

5

Is CVE-2020-36322 fixed in the latest Linux kernels?

Yes, CVE-2020-36322 is resolved in Linux kernel versions 5.10.6 and higher.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203