medium5.5
CVE-2020-9391
An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture.
Impact
An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linux | Linux Kernel | from 5.5 through 5.5.6 Version 5.4 |
| Fedoraproject | Fedora | Version 31 |
| Netapp | Active Iq Unified Manager | All versions |
| Netapp | Cloud Backup | All versions |
| Netapp | Data Availability Services | All versions |
| Netapp | Hci Management Node | All versions |
| Netapp | Solidfire | All versions |
| Netapp | Steelstore Cloud Integrated Storage | All versions |
| Netapp | H410c Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2020/02/25/6
- https://bugzilla.redhat.com/show_bug.cgi?id=1797052
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dcde237319e626d1ec3c9d8b7613032f0fd4663a
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O4LH35HOPBJIKYHYFXMBBM75DN75PZHZ/
- https://security.netapp.com/advisory/ntap-20200313-0003/
- http://www.openwall.com/lists/oss-security/2020/02/25/6
- https://bugzilla.redhat.com/show_bug.cgi?id=1797052
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dcde237319e626d1ec3c9d8b7613032f0fd4663a
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O4LH35HOPBJIKYHYFXMBBM75DN75PZHZ/
- https://security.netapp.com/advisory/ntap-20200313-0003/