CVE-2020-14356
HIGH
7.8
CVSS Score
Published: August 19, 2020 at 02:37 PM UTC
Updated: June 17, 2026 at 02:54 AM UTC
12 products affected across 6 vendorsLinux KernelDebian LinuxUbuntu Linux
Using Kernel by N/A?
Get instant alerts when new vulnerabilities affect Kernel - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 1%
Description
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Ubuntu Linux· Canonicalrubygems
95%Debian Linux· Debiandrupal
95%4.10 ≤ v < 4.14.1894.15 ≤ v < 4.19.1344.20 ≤ v < 5.4.534.5 ≤ v < 4.9.2315.5 ≤ v < 5.7.10
Affected range stops below 4.14.189, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.19.134, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.9.231, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.4.53, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.7.10, so it looks safe — our inference, not a vendor statement
All versions
Cloud Backup· NetAppdrupal
95%All versions
All versions
All versions
netapp-solidfire-baseboard-management-controller (same device)
Leap· openSUSEdrupal
95%Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
- https://bugzilla.kernel.org/show_bug.cgi?id=208003
- https://bugzilla.redhat.com/show_bug.cgi?id=1868453
- https://lore.kernel.org/netdev/CAM_iQpUKQJrj8wE+Qa8NGR3P0L+5Uz=qo-O5+k_P60HzTde6aw%40mail.gmail.com/t/
References (12)
Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.htmlVendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.htmlx_refsource_MISCExploitIssue TrackingVendor Advisory
Source: [email protected]
https://bugzilla.kernel.org/show_bug.cgi?id=208003x_refsource_MISCIssue TrackingPatchThird Party Advisory
Source: [email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=1868453Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlMailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlx_refsource_MISCExploitVendor Advisory
Source: [email protected]
https://lore.kernel.org/netdev/CAM_iQpUKQJrj8wE+Qa8NGR3P0L+5Uz=qo-O5+k_P60HzTde6aw%40mail.gmail.com/t/CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-476
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card