Vulnerability · Published Apr 12, 2020 · Assigned by mitre
CVE-2020-11725
High 7.8
In plain English
A high-severity security flaw in the linux package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
snd_ctl_elem_add in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info->owner line, which later affects a private_size*count multiplication for unspecified "interesting side effects." NOTE: kernel engineers dispute this finding, because it could be relevant only if new callers were added that were unfamiliar with the misuse of the info->owner field to represent data unrelated to the "owner" concept. The existing callers, SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE, have been designed to misuse the info->owner field in a safe way
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | no fix listed | DEBIAN-CVE-2020-11725 |
| Debian:13 | linux | no fix listed | DEBIAN-CVE-2020-11725 |
| Debian:14 | linux | no fix listed | DEBIAN-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-aws | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-azure | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-gcp | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-gke | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-gkeop | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-ibm | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-intel-iotg | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-kvm | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-lowlatency | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-oracle | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-raspi | no fix listed | UBUNTU-CVE-2020-11725 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2020-11725 |
Affected products (as reported)
Weakness: CWE-704 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H