CVE-2020-13143

Advisory lineage Upstream: 0 Downstream: 28
Modified
Published: 18 May 2020, 17:50
Last modified:04 Aug 2024, 12:11

Vulnerability Summary

Overall Risk (default)
medium
27/100
CVSS Score
6.5 MEDIUM
v3.1 (nvd)
EPSS Score
2.98% LOW
3% probability -0.29%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

18 May 2020, 17:50
Published
Vulnerability first disclosed
04 Aug 2024, 12:11
Last Modified
Vulnerability information updated

Description

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 2.98%• Percentile: 87%

Techniques & Countermeasures

  • CWE-125•Out-of-bounds Read

    The product reads data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • canonical•ubuntu_linux

    14.04 | 16.04 | 18.04 | 19.10 | 20.04

  • debian•debian_linux

    8.0 | 9.0 | 10.0

  • linux•linux_kernel

    ≥ 3.16, ≤ 5.6.13

  • netapp•a700s_firmware

    na

  • netapp•active_iq_unified_manager

    na

  • netapp•bootstrap_os

    na

  • netapp•cloud_backup

    na

  • netapp•element_software

    na

  • netapp•h300e

    na

  • netapp•h300s_firmware

    na

  • netapp•h410c_firmware

    na

  • netapp•h410s_firmware

    na

  • netapp•h500e

    na

  • netapp•h500s_firmware

    na

  • netapp•h610c_firmware

    na

  • netapp•h610s_firmware

    na

  • netapp•h615c_firmware

    na

  • netapp•h700e

    na

  • netapp•h700s_firmware

    na

  • netapp•hci_management_node

    na

  • netapp•solidfire

    na

  • netapp•solidfire_baseboard_management_controller_firmware

    na

  • netapp•steelstore_cloud_integrated_storage

    na

  • opensuse•leap

    15.1 | 15.2

References (16)