Vulnerability · Published Nov 18, 2020 · Assigned by mitre
CVE-2020-28915
Medium 5.8
In plain English
A medium-severity security flaw in the bpftool package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.8Medium
Exploit odds (30 days)0.4%top 67.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bpftool | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-abi-stablelists | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-core | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-cross-headers | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-debug | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-debug-core | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-debug-devel | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-debug-modules | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-debug-modules-extra | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-devel | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-doc | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-modules | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-modules-extra | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-rt | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-core | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-debug | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-debug-core | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-debug-devel | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-debug-kvm | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-debug-modules | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-debug-modules-extra | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-devel | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-kvm | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-modules | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-rt-modules-extra | 4.18.0-372.13.1.rt7.170.el8_6 | ALSA-2022:5344 |
| AlmaLinux:8 | kernel-tools | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-tools-libs | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | perf | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| AlmaLinux:8 | python3-perf | 4.18.0-372.13.1.el8_6 | ALSA-2022:5316 |
| Debian:12 | linux | 5.9.1-1 | DEBIAN-CVE-2020-28915 |
| Debian:13 | linux | 5.9.1-1 | DEBIAN-CVE-2020-28915 |
| Debian:14 | linux | 5.9.1-1 | DEBIAN-CVE-2020-28915 |
| Rocky Linux:8 | kernel | 0:4.18.0-372.13.1.el8_6 | RLSA-2022:5316 |
| Rocky Linux:8 | kernel-rt | 0:4.18.0-372.13.1.rt7.170.el8_6 | RLSA-2022:5344 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2020-28915 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2020-28915 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-28915 |
Affected products (as reported)
References
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.15 x_refsource_MISC
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6735b4632def0640dbdf4eb9f99816aca18c4f16 x_refsource_MISC
- https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd x_refsource_MISC
- https://bugzilla.suse.com/show_bug.cgi?id=1178886 x_refsource_MISC
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5af08640795b2b9a940c9266c0260455377ae262 x_refsource_MISC