Vulnerability · Published Jun 26, 2020 · Assigned by redhat

CVE-2020-10769

Medium 5.5

In plain English

A medium-severity security flaw in Kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	linux	4.19.20-1	DEBIAN-CVE-2020-10769
Debian:13	linux	4.19.20-1	DEBIAN-CVE-2020-10769
Debian:14	linux	4.19.20-1	DEBIAN-CVE-2020-10769
Ubuntu:22.04:LTS	linux-intel-iot-realtime	no fix listed	UBUNTU-CVE-2020-10769
Ubuntu:24.04:LTS	linux-raspi-realtime	no fix listed	UBUNTU-CVE-2020-10769
Ubuntu:22.04:LTS	linux-realtime	no fix listed	UBUNTU-CVE-2020-10769
Ubuntu:22.04:LTS	linux-riscv	no fix listed	UBUNTU-CVE-2020-10769

Affected products (as reported)

Vendor	Product	Versions
n/a	Kernel	All kernel versions before 5.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=1708775%3B x_refsource_MISC
https://lkml.org/lkml/2019/1/21/675 x_refsource_MISC
openSUSE-SU-2020:1153 vendor-advisory, x_refsource_SUSE
https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC