Vulnerability Details : CVE-2020-14385
A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability.
Vulnerability category: Denial of service
Products affected by CVE-2020-14385
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.9.0:-:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.9.0:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.9.0:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.9.0:rc3:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-14385
0.03%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-14385
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.7
|
MEDIUM | AV:L/AC:M/Au:N/C:N/I:N/A:C |
3.4
|
6.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
Red Hat, Inc. | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2020-14385
-
The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
References for CVE-2020-14385
-
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html
[security-announce] openSUSE-SU-2020:1586-1: important: Security updateBroken Link
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14385
1874800 – (CVE-2020-14385) CVE-2020-14385 kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be flagged as corruptIssue Tracking;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
[SECURITY] [DLA 2385-1] linux-4.19 security updateMailing List;Third Party Advisory
-
https://usn.ubuntu.com/4576-1/
USN-4576-1: Linux kernel vulnerabilities | Ubuntu security notices | UbuntuThird Party Advisory
-
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f4020438fab05364018c91f7e02ebdd192085933
kernel/git/torvalds/linux.git - Linux kernel source treePatch;Vendor Advisory
Jump to