Vulnerability · Published Aug 19, 2020 · Assigned by redhat
CVE-2020-14356
High 7.8
In plain English
A high-severity security flaw in Kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)1.0%top 36.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-305.el8 | ALSA-2021:1578 |
| Debian:12 | linux | 5.7.10-1 | DEBIAN-CVE-2020-14356 |
| Debian:13 | linux | 5.7.10-1 | DEBIAN-CVE-2020-14356 |
| Debian:14 | linux | 5.7.10-1 | DEBIAN-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-aws | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-aws | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-aws-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-azure | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-azure | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-azure-6.11 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-azure-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:25.10 | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:26.04:LTS | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:26.10 | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-azure-fde-6.17 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-azure-fde-7.0 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-azure-nvidia | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-gcp | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-gcp | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-gcp-6.11 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-gcp-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-gke | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-gke | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:26.04:LTS | linux-gke | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-gkeop | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-gkeop | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-hwe-6.11 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-hwe-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-ibm | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-ibm | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:26.04:LTS | linux-ibm | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-ibm-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-intel | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-intel-iotg | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-kvm | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-lowlatency | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-lowlatency | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-lowlatency-hwe-6.11 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-nvidia | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-nvidia | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:26.04:LTS | linux-nvidia | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-nvidia-6.11 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-nvidia-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-nvidia-7.0 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:26.04:LTS | linux-nvidia-bos | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-nvidia-lowlatency | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-nvidia-tegra | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-oem-6.11 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-oem-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-oracle | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-oracle | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-oracle-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-raspi | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-raspi | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:25.10 | linux-realtime | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:26.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:26.10 | linux-realtime | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-riscv-6.8 | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-vmware | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:24.04:LTS | linux-xilinx | no fix listed | UBUNTU-CVE-2020-14356 |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | no fix listed | UBUNTU-CVE-2020-14356 |
Affected products (as reported)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1868453 x_refsource_MISC
- https://bugzilla.kernel.org/show_bug.cgi?id=208003 x_refsource_MISC
- https://lore.kernel.org/netdev/CAM_iQpUKQJrj8wE+Qa8NGR3P0L+5Uz=qo-O5+k_P60HzTde6aw%40mail.gmail.com/t/ x_refsource_MISC
- openSUSE-SU-2020:1236 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1325 vendor-advisory, x_refsource_SUSE
- https://security.netapp.com/advisory/ntap-20200904-0002/ x_refsource_CONFIRM
- USN-4484-1 vendor-advisory, x_refsource_UBUNTU
- USN-4483-1 vendor-advisory, x_refsource_UBUNTU
- USN-4526-1 vendor-advisory, x_refsource_UBUNTU
- [debian-lts-announce] 20200928 [SECURITY] [DLA 2385-1] linux-4.19 security update mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20201030 [SECURITY] [DLA 2420-1] linux security update mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20201031 [SECURITY] [DLA 2420-2] linux regression update mailing-list, x_refsource_MLIST