CVE-2020-0067
Published: 17 April 2020
In f2fs_xattr_generic_list of xattr.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: Android. Versions: Android kernel. Android ID: A-120551147.
From the Ubuntu Security Team
It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A local attacker could possibly use this to expose sensitive information (kernel memory).
Priority
Status
Package | Release | Status |
---|---|---|
linux
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-106.107)
|
eoan |
Released
(5.3.0-59.53)
|
|
focal |
Released
(5.4.0-37.41)
|
|
trusty |
Ignored
(was needed ESM criteria)
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-190.220)
|
|
Patches:
Introduced by
af48b85b8cd3fbb12c9b6759c16db6d69c0b03da
|
||
linux-aws
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1073.77)
|
eoan |
Released
(5.3.0-1023.25)
|
|
focal |
Released
(5.4.0-1015.15)
|
|
trusty |
Released
(4.4.0-1078.82)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1114.127)
|
|
linux-aws-5.0
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-aws-5.3
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1023.25~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-aws-5.4
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1018.18~18.04.1)
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-aws-hwe
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1073.77~16.04.1)
|
|
linux-azure
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
eoan |
Released
(5.3.0-1028.29)
|
|
focal |
Released
(5.4.0-1016.16)
|
|
trusty |
Released
(4.15.0-1089.99~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1089.99~16.04.1)
|
|
linux-azure-4.15
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1089.99)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-azure-5.3
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1028.29~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-azure-5.4
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1020.20~18.04.1)
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-azure-edge
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
eoan |
Released
(5.3.0-1026.28)
|
|
focal |
Released
(5.4.0-1015.15)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1077.87~16.04.1)
|
|
linux-gcp-4.15
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1077.87)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp-5.3
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1026.28~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp-5.4
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1019.19~18.04.2)
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp-edge
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-4.15
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1063.66)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-5.0
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1042.43)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-5.3
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1026.28~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-hwe
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-59.53~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-106.107~16.04.1)
|
|
linux-hwe-5.4
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-37.41~18.04.1)
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-hwe-edge
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Ignored
(end of life, was needs-triage)
|
|
linux-kvm
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1067.68)
|
eoan |
Released
(5.3.0-1023.25)
|
|
focal |
Released
(5.4.0-1015.15)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1080.87)
|
|
linux-lts-trusty
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-lts-xenial
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Released
(4.4.0-190.220~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oem
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1087.97)
|
eoan |
Ignored
(end of life)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Ignored
(end of standard support, was needs-triage)
|
|
linux-oem-5.6
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Not vulnerable
(5.6.0-1007.7)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oem-osp1
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1059.64)
|
eoan |
Ignored
(end of life)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oracle
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1045.49)
|
eoan |
Released
(5.3.0-1024.26)
|
|
focal |
Released
(5.4.0-1015.15)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1045.49~16.04.1)
|
|
linux-oracle-5.0
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oracle-5.3
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1024.26~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oracle-5.4
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1019.19~18.04.1)
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-raspi
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Released
(5.4.0-1012.12)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-raspi-5.4
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1013.13~18.04.1)
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-raspi2
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1063.67)
|
eoan |
Released
(5.3.0-1027.29)
|
|
focal |
Ignored
(end of life, was needs-triage)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1139.148)
|
|
linux-raspi2-5.3
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1027.29~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-riscv
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Released
(5.4.0-27.31)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-snapdragon
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1080.87)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1143.152)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 4.4 |
Attack vector | Local |
Attack complexity | Low |
Privileges required | High |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
References
- https://git.kernel.org/linus/688078e7f36c293dae25b338ddc9e0a2790f6e06
- https://ubuntu.com/security/notices/USN-4387-1
- https://ubuntu.com/security/notices/USN-4389-1
- https://ubuntu.com/security/notices/USN-4390-1
- https://ubuntu.com/security/notices/USN-4388-1
- https://ubuntu.com/security/notices/USN-4527-1
- https://www.cve.org/CVERecord?id=CVE-2020-0067
- https://ubuntu.com/security/notices/LSN-0072-1
- NVD
- Launchpad
- Debian