CVE-2020-9383: High severity Linux Linux kernel vulnerability

Published Feb 21, 2020
·
Updated

An issue was discovered in the Linux kernel 3.16 through 5.5.6. setfdc in drivers/block/floppy.c leads to a waittilready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2.

Other sources

An out of bounds (OOB) memory access flaw was found in setfdc in drivers/block/floppy.c in floppy driver module . This could allow a local attacker to crash the system or leak kernel internal information.

Reference and upstream commit: https://github.com/torvalds/linux/commit/2e90ca68b0d2f5548804f22f0dd61145516171e3

— Red Hat

An out-of-bounds (OOB) memory access flaw was found in the floppy driver module in the Linux kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.

Affected Software

81 affected componentsFixes available
redhat/kernel-rt<0:3.10.0-1160.rt56.1131.el7
0:3.10.0-1160.rt56.1131.el7
redhat/kernel-alt<0:4.14.0-115.21.2.el7a
0:4.14.0-115.21.2.el7a
redhat/kernel<0:3.10.0-1160.el7
0:3.10.0-1160.el7
Linux Linux kernel>=3.16<=5.5.6
Debian Debian Linux=8.0
Debian Debian Linux=9.0
openSUSE Leap=15.1
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.10
NetApp Active Iq Unified Manager Vmware Vsphere
NetApp Cloud Backup
NetApp Data Availability Services
NetApp Hci Management Node
NetApp Solidfire
NetApp Steelstore Cloud Integrated Storage
NetApp Solidfire Baseboard Management Controller Firmware
NetApp Solidfire Baseboard Management Controller
NetApp H410c Firmware
NetApp H410c
All of the following
NetApp Solidfire Baseboard Management Controller Firmware
NetApp Solidfire Baseboard Management Controller
All of the following
NetApp H410c Firmware
NetApp H410c
ubuntu/linux-aws<4.4.0-1066.70
4.4.0-1066.70
ubuntu/linux-azure<4.15.0-1082.92~14.04.1
4.15.0-1082.92~14.04.1
ubuntu/linux-lts-xenial<4.4.0-178.208~14.04.1
4.4.0-178.208~14.04.1
ubuntu/linux*
ubuntu/linux<4.4.0-178.208
4.4.0-178.208
ubuntu/linux-aws<4.4.0-1106.117
4.4.0-1106.117
ubuntu/linux-aws-hwe<4.15.0-1066.70~16.04.1
4.15.0-1066.70~16.04.1
ubuntu/linux-azure<4.15.0-1082.92~16.04.1
4.15.0-1082.92~16.04.1
ubuntu/linux-gcp<4.15.0-1061.65
4.15.0-1061.65
ubuntu/linux-hwe<4.15.0-99.100~16.04.1
4.15.0-99.100~16.04.1
ubuntu/linux-kvm<4.4.0-1070.77
4.4.0-1070.77
ubuntu/linux-oracle<4.15.0-1038.42~16.04.1
4.15.0-1038.42~16.04.1
ubuntu/linux-raspi2<4.4.0-1132.141
4.4.0-1132.141
ubuntu/linux-snapdragon<4.4.0-1136.144
4.4.0-1136.144
ubuntu/linux-hwe-edge*
ubuntu/linux-fips<4.4.0-1033.38
4.4.0-1033.38
ubuntu/linux-fips*
ubuntu/linux<4.15.0-99.100
4.15.0-99.100
ubuntu/linux-aws<4.15.0-1066.70
4.15.0-1066.70
ubuntu/linux-aws-5.3<5.3.0-1017.18~18.04.1
5.3.0-1017.18~18.04.1
ubuntu/linux-azure-5.3<5.3.0-1020.21~18.04.1
5.3.0-1020.21~18.04.1
ubuntu/linux-gcp-5.3<5.3.0-1018.19~18.04.1
5.3.0-1018.19~18.04.1
ubuntu/linux-gke-4.15<4.15.0-1058.61
4.15.0-1058.61
ubuntu/linux-gke-5.0<5.0.0-1035.36
5.0.0-1035.36
ubuntu/linux-gke-5.3<5.3.0-1018.19~18.04.1
5.3.0-1018.19~18.04.1
ubuntu/linux-hwe<5.3.0-51.44~18.04.2
5.3.0-51.44~18.04.2
ubuntu/linux-kvm<4.15.0-1059.60
4.15.0-1059.60
ubuntu/linux-oem<4.15.0-1080.90
4.15.0-1080.90
ubuntu/linux-oem-osp1<5.0.0-1050.55
5.0.0-1050.55
ubuntu/linux-oracle<4.15.0-1038.42
4.15.0-1038.42
ubuntu/linux-oracle-5.3<5.3.0-1016.18~18.04.1
5.3.0-1016.18~18.04.1
ubuntu/linux-raspi2<4.15.0-1061.65
4.15.0-1061.65
ubuntu/linux-raspi2-5.3<5.3.0-1023.25~18.04.1
5.3.0-1023.25~18.04.1
ubuntu/linux-snapdragon<4.15.0-1077.84
4.15.0-1077.84
ubuntu/linux-aws-5.0*
ubuntu/linux-azure*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-edge*
ubuntu/linux-hwe-edge*
ubuntu/linux-oracle-5.0*
ubuntu/linux-aws-fips<4.15.0-2018.18
4.15.0-2018.18
ubuntu/linux-azure-fips<4.15.0-2006.7
4.15.0-2006.7
ubuntu/linux-fips<4.15.0-1029.34
4.15.0-1029.34
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-5.15<5.15.0-1114.123~20.04.1
5.15.0-1114.123~20.04.1
ubuntu/linux-gke*
ubuntu/linux-raspi2*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-raspi-realtime*
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1160.rt56.1131.el7
  2. Upgrade

    Upgrade redhat/kernel-alt to a version that resolves this vulnerability.

    Fixed in 0:4.14.0-115.21.2.el7a
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1160.el7
  4. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1066.70
  5. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1082.92~14.04.1
  6. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-178.208~14.04.1
  7. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-178.208
  8. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1106.117
  9. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1066.70~16.04.1
  10. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1082.92~16.04.1
  11. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1061.65
  12. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-99.100~16.04.1
  13. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1070.77
  14. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1038.42~16.04.1
  15. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.4.0-1132.141
  16. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.4.0-1136.144
  17. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1033.38
  18. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-99.100
  19. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1066.70
  20. Upgrade

    Upgrade ubuntu/linux-aws-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1017.18~18.04.1
  21. Upgrade

    Upgrade ubuntu/linux-azure-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1020.21~18.04.1
  22. Upgrade

    Upgrade ubuntu/linux-gcp-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1018.19~18.04.1
  23. Upgrade

    Upgrade ubuntu/linux-gke-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1058.61
  24. Upgrade

    Upgrade ubuntu/linux-gke-5.0 to a version that resolves this vulnerability.

    Fixed in 5.0.0-1035.36
  25. Upgrade

    Upgrade ubuntu/linux-gke-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1018.19~18.04.1
  26. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 5.3.0-51.44~18.04.2
  27. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1059.60
  28. Upgrade

    Upgrade ubuntu/linux-oem to a version that resolves this vulnerability.

    Fixed in 4.15.0-1080.90
  29. Upgrade

    Upgrade ubuntu/linux-oem-osp1 to a version that resolves this vulnerability.

    Fixed in 5.0.0-1050.55
  30. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1038.42
  31. Upgrade

    Upgrade ubuntu/linux-oracle-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1016.18~18.04.1
  32. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1061.65
  33. Upgrade

    Upgrade ubuntu/linux-raspi2-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1023.25~18.04.1
  34. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.15.0-1077.84
  35. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2018.18
  36. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2006.7
  37. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1029.34
  38. Upgrade

    Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1114.123~20.04.1
  39. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1
  40. Configuration

    Blacklist the affected floppy driver module so it is not loaded automatically at boot until a fix is available.

    Linux kernel floppy driver module blacklist = floppy

Event History

Feb 21, 2020
CVE Published
12:00 AM
Feb 25, 2020
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·03:48 PM
Data Sourced
via MITRE·03:48 PM
Description
Data Sourced
via OSV·04:15 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Mar 5, 2020
Data Sourced
via Red Hat·06:01 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2020-9383?

CVE-2020-9383 is classified as a medium severity vulnerability that can lead to an out-of-bounds read in the Linux kernel.

2

How do I fix CVE-2020-9383?

To fix CVE-2020-9383, upgrade to a patched version of the Linux kernel, such as kernel-rt 0:3.10.0-1160.rt56.1131.el7 or kernel 0:4.14.0-115.21.2.el7a.

3

Which versions of the Linux kernel are affected by CVE-2020-9383?

CVE-2020-9383 affects Linux kernel versions from 3.16 up to 5.5.6.

4

What type of vulnerability is CVE-2020-9383?

CVE-2020-9383 is an out-of-bounds memory access vulnerability found in the set_fdc function of the Linux kernel.

5

Which operating systems are impacted by CVE-2020-9383?

Operating systems that include affected versions of the Linux kernel, such as certain distributions of Debian, Ubuntu, and Red Hat, are impacted by CVE-2020-9383.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203