VulnerabilityModified

CVE-2020-13143

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka…

MEDIUM 6.5EPSS 4.50%

Does this matter?

Lower severity and a low EPSS score (4.50%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 4.50% probability · 91th percentile
CISA KEV: Not listed
Weakness: CWE-125
Affected: linux/linux kernel · opensuse/leap · debian/debian linux · canonical/ubuntu linux · netapp/active iq unified manager · netapp/cloud backup · netapp/element software · netapp/hci management node · netapp/solidfire · netapp/steelstore cloud integrated storage · netapp/solidfire baseboard management controller firmware · netapp/bootstrap os · netapp/a700s firmware · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h300e firmware · netapp/h500e firmware · netapp/h700e firmware · netapp/h410s firmware · +4 more
Source: cve@mitre.org

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.htmlMailing List, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=d126cf46f829d146dde3e6a8963e095ac6cfcd1cMailing List, Patch, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=15753588bcd4bbffae1cca33c8ced5722477fe1fPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00012.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200608-0001/Third Party Advisory
https://usn.ubuntu.com/4411-1/Third Party Advisory
https://usn.ubuntu.com/4412-1/Third Party Advisory
https://usn.ubuntu.com/4413-1/Third Party Advisory
https://usn.ubuntu.com/4414-1/Third Party Advisory
https://usn.ubuntu.com/4419-1/Third Party Advisory
https://www.debian.org/security/2020/dsa-4698Third Party Advisory
https://www.debian.org/security/2020/dsa-4699Third Party Advisory
https://www.spinics.net/lists/linux-usb/msg194331.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.htmlMailing List, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=d126cf46f829d146dde3e6a8963e095ac6cfcd1cMailing List, Patch, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=15753588bcd4bbffae1cca33c8ced5722477fe1fPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00012.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200608-0001/Third Party Advisory
https://usn.ubuntu.com/4411-1/Third Party Advisory
https://usn.ubuntu.com/4412-1/Third Party Advisory
https://usn.ubuntu.com/4413-1/Third Party Advisory
https://usn.ubuntu.com/4414-1/Third Party Advisory
https://usn.ubuntu.com/4419-1/Third Party Advisory
https://www.debian.org/security/2020/dsa-4698Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.