CVE-2020-12656: canonical ubuntu_linux

CVSS: 5.5v3.1MediumModified

AliasesUBUNTU-CVE-2020-12656DEBIAN-CVE-2020-12656

Published 05-05-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-12656 is a medium (CVSS 5.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.3% of scored vulnerabilities.

Overall risk

22/100

0100

Low · default modelHow is this calculated?

CVSS score

5.5/10

010

Medium · v3.1 (NVD)

EPSS score

0.33%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

05-05-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a problem that on unloading a specific kernel module some memory is leaked, but loading kernel modules is a privileged operation. A user could also write a kernel module to consume any amount of memory they like and load that replicating the effect of this bug

CVSS metrics

4 scores · 3 sources · 2 versions

v3.15.5v2.02.1

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

0.00 pp

From 0.33% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected systems

Ubuntu47 products

linuxAll versions (No fix recorded) | < 4.4.0-186.216 | < 4.15.0-115.116 | < 5.4.0-45.49
linux-aws< 4.4.0-1075.79 | < 4.4.0-1111.123 | < 4.15.0-1080.84 | < 5.4.0-1022.22
linux-aws-5.0All versions (No fix recorded)
linux-aws-5.3All versions (No fix recorded)
linux-aws-5.4< 5.4.0-1022.22~18.04.1

linux-aws-fips< 4.15.0-2025.25 | All versions (No fix recorded) | < 5.4.0-1069.73+fips2
linux-aws-hwe< 4.15.0-1080.84~16.04.1
linux-azure< 4.15.0-1093.103~14.04.1 | < 4.15.0-1093.103~16.04.1 | All versions (No fix recorded) | < 5.4.0-1023.23
linux-azure-4.15< 4.15.0-1093.103
linux-azure-5.3All versions (No fix recorded)
linux-azure-5.4< 5.4.0-1023.23~18.04.1
linux-azure-edgeAll versions (No fix recorded)
linux-azure-fdeAll versions (No fix recorded)
linux-azure-fde-5.15< 5.15.0-1114.123~20.04.1
linux-azure-fips< 4.15.0-2007.8 | All versions (No fix recorded) | < 5.4.0-1073.76+fips1
linux-fips< 4.4.0-1043.48 | All versions (No fix recorded) | < 4.15.0-1039.44
linux-gcp< 4.15.0-1081.92~16.04.1 | All versions (No fix recorded) | < 5.4.0-1022.22
linux-gcp-4.15< 4.15.0-1081.92
linux-gcp-5.3All versions (No fix recorded)
linux-gcp-5.4< 5.4.0-1022.22~18.04.1
linux-gcp-edgeAll versions (No fix recorded)
linux-gcp-fipsAll versions (No fix recorded) | < 5.4.0-1067.71~20.04.1
linux-gkeAll versions (No fix recorded)
linux-gke-4.15< 4.15.0-1067.70
linux-gke-5.0< 5.0.0-1045.46
linux-gke-5.3< 5.3.0-1032.34~18.04.1
linux-hwe< 4.15.0-115.116~16.04.1 | < 5.3.0-64.58~18.04.1
linux-hwe-5.4< 5.4.0-45.49~18.04.2
linux-hwe-edgeAll versions (No fix recorded)
linux-intel-iot-realtimeAll versions (No fix recorded)
linux-kvm< 4.4.0-1077.84 | < 4.15.0-1072.73 | < 5.4.0-1021.21
linux-lts-xenial< 4.4.0-186.216~14.04.1
linux-oem< 4.15.0-1094.104
linux-oem-5.6< 5.6.0-1031.32
linux-oem-osp1< 5.0.0-1065.70
linux-oracle< 4.15.0-1051.55~16.04.1 | < 4.15.0-1051.55 | < 5.4.0-1022.22
linux-oracle-5.0All versions (No fix recorded)
linux-oracle-5.3All versions (No fix recorded)
linux-oracle-5.4< 5.4.0-1022.22~18.04.1
linux-raspi< 5.4.0-1016.17
linux-raspi-5.4< 5.4.0-1016.17~18.04.1
linux-raspi-realtimeAll versions (No fix recorded)
linux-raspi2< 4.4.0-1136.145 | < 4.15.0-1068.72 | All versions (No fix recorded)
linux-raspi2-5.3< 5.3.0-1030.32~18.04.2
linux-realtimeAll versions (No fix recorded)
linux-riscv< 5.4.0-31.35 | All versions (No fix recorded)
linux-snapdragon< 4.4.0-1140.148 | < 4.15.0-1084.92

Show all 47

Canonical1 product

ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 20.04

Debian1 product

linux< 5.7.6-1

Linux1 product

linux_kernel≤ 5.6.10

Opensuse1 product

leapEOL15.1 | 15.2

5 vendors · 51 products

References

11 links

bugzilla.kernel.org/show_bug.cgi?id=206651X Refsource MISCREPORTIssue TrackingVendor Advisory
lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
usn.ubuntu.com/4483-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
usn.ubuntu.com/4485-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
ubuntu.com/security/CVE-2020-12656REPORT
ubuntu.com/security/notices/USN-4483-1Advisory
ubuntu.com/security/notices/USN-4485-1Advisory
www.cve.org/CVERecord?id=CVE-2020-12656REPORT
security-tracker.debian.org/tracker/CVE-2020-12656Advisory

Show all 11 references

nvd.nist.gov/vuln/detail/CVE-2020-12656OvalAdvisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities