NetSight
IP …
medium6.5

CVE-2020-13143

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an …

Impact

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.16 through 5.6.13
OpensuseLeap
Versions 15.1, 15.2
DebianDebian Linux
Versions 8.0, 9.0, 10.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 19.10, 20.04
NetappActive Iq Unified Manager
All versions
NetappCloud Backup
All versions
NetappElement Software
All versions
NetappHci Management Node
All versions
NetappSolidfire
All versions
NetappSteelstore Cloud Integrated Storage
All versions
NetappSolidfire Baseboard Management Controller Firmware
All versions
NetappBootstrap Os
All versions

Weakness classification

CWE-125

References