CVE-2020-13143

Public on 2020-05-18

Modified on 2022-01-10

Description

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal 0 value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.

Severity

Low

See what this means

CVSS v3 Base Score

4.0

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory
Amazon Linux 2 - Kernel-5.4 Extra	kernel	2022-01-20 19:20	ALAS2KERNEL-5.4-2022-012

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	4.0	CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD	CVSSv3	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD	CVSSv2	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P

References

Red Hat: CVE-2020-13143 Mitre: CVE-2020-13143 FAQs regarding Amazon Linux ALAS/CVE Severity