CVE-2020-14386: debian debian_linux Execution with Unnecessary Privileges
Modified
AliasesSUSE-SU-2020:2577-1SUSE-SU-2020:2578-1SUSE-SU-2020:2579-1SUSE-SU-2020:2580-1LSN-0071-1UBUNTU-CVE-2020-14386USN-4489-1DEBIAN-CVE-2020-14386openSUSE-SU-2020:1379-1
Published 16-09-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-14386 is a high (CVSS 7.8) Execution with Unnecessary Privileges vulnerability in debian debian_linux. EPSS estimates a 1.32% chance of exploitation in the next 30 days, higher than 70.8% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6.7, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
1.32%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 30 · Related 20DLA-2385-1DLA-2420-1LSN-0072-1MGASA-2020-0392OPENSUSE-SU-2020:1382-1OPENSUSE-SU-2020:1655-1OPENSUSE-SU-2021:0242-1OPENSUSE-SU-2024:10728-1OPENSUSE-SU-2024:13704-1RHSA-2020:4286RHSA-2020:4287RHSA-2020:4289RHSA-2020:4331RHSA-2020:4332RHSA-2020:5199SUSE-SU-2020:2574-1SUSE-SU-2020:2575-1SUSE-SU-2020:2576-1SUSE-SU-2020:2582-1SUSE-SU-2020:2610-1SUSE-SU-2020:2623-1SUSE-SU-2020:2999-1SUSE-SU-2020:3014-1SUSE-SU-2020:3180-1SUSE-SU-2020:3186-1SUSE-SU-2020:3187-1SUSE-SU-2020:3190-1SUSE-SU-2020:3204-1SUSE-SU-2020:3210-1SUSE-SU-2020:3225-1
Timeline
- 16-09-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources4 sources · 6.7–7.8
- CVE.orgCNA6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
High 7.2Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
1.32%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 1.31% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Version check
Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu45 products
- linux< 4.15.0-117.118 | < 5.4.0-47.51
- linux-aws< 4.15.0-1082.86 | < 5.4.0-1024.24
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3< 5.3.0-1035.37
- linux-aws-5.4< 5.4.0-1024.24~18.04.1
Suse25 products
- kernel-azure&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP1< 4.12.14-8.44.1
- kernel-azure&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP2< 5.3.18-18.18.1
- kernel-azure&distro=SUSE Linux Enterprise Server 12 SP5< 4.12.14-16.28.1
- kernel-azure&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 4.12.14-16.28.1
- kernel-default&distro=SUSE Linux Enterprise High Availability Extension 15 SP2< 5.3.18-24.15.1
Opensuse10 products
- leapEOL15.1
- kernel-debug&distro=openSUSE Leap 15.1< 4.12.14-lp151.28.67.2
- kernel-default&distro=openSUSE Leap 15.1< 4.12.14-lp151.28.67.2
- kernel-docs&distro=openSUSE Leap 15.1< 4.12.14-lp151.28.67.3
- kernel-kvmsmall&distro=openSUSE Leap 15.1< 4.12.14-lp151.28.67.2
Debian2 products
- linux< 5.8.7-1
- debian_linuxEOL9.0
Fedoraproject1 product
- fedoraEOL33
Linux1 product
- linux_kernel≥ 4.6, < 4.9.239 | ≥ 4.10, < 4.14.201 | ≥ 4.15, < 4.19.150 | ≥ 4.20, < 5.4.64 | ≥ 5.5, < 5.8.8 | 5.9.0:rc1 | 5.9.0:rc2 | 5.9.0:rc3
Linux kernel1 product
- kernel< 5.9-rc4
7 vendors · 85 products
References
62 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14386X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 62 references
- lists.opensuse.org/archives/…Advisory
