CVE-2020-9383: High severity Linux Linux kernel vulnerability
An issue was discovered in the Linux kernel 3.16 through 5.5.6. setfdc in drivers/block/floppy.c leads to a waittilready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2.
Other sources
An out of bounds (OOB) memory access flaw was found in setfdc in drivers/block/floppy.c in floppy driver module . This could allow a local attacker to crash the system or leak kernel internal information.
Reference and upstream commit: https://github.com/torvalds/linux/commit/2e90ca68b0d2f5548804f22f0dd61145516171e3
— Red Hat
An out-of-bounds (OOB) memory access flaw was found in the floppy driver module in the Linux kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.rt56.1131.el7 - Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.21.2.el7a - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.el7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1 - Configuration
Blacklist the affected kernel module by adding `blacklist floppy` to a modprobe blacklist file (e.g., `/etc/modprobe.d/blacklist-floppy.conf`) so the `floppy` driver module is not loaded automatically at boot time until a fix is available.
Linux kernel module loader (modprobe) blacklist floppy driver module = floppy
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-9383?
CVE-2020-9383 is classified as a medium severity vulnerability that can lead to an out-of-bounds read in the Linux kernel.
How do I fix CVE-2020-9383?
To fix CVE-2020-9383, upgrade to a patched version of the Linux kernel, such as kernel-rt 0:3.10.0-1160.rt56.1131.el7 or kernel 0:4.14.0-115.21.2.el7a.
Which versions of the Linux kernel are affected by CVE-2020-9383?
CVE-2020-9383 affects Linux kernel versions from 3.16 up to 5.5.6.
What type of vulnerability is CVE-2020-9383?
CVE-2020-9383 is an out-of-bounds memory access vulnerability found in the set_fdc function of the Linux kernel.
Which operating systems are impacted by CVE-2020-9383?
Operating systems that include affected versions of the Linux kernel, such as certain distributions of Debian, Ubuntu, and Red Hat, are impacted by CVE-2020-9383.