CVE-2020-10942
published 2020-03-24CVE-2020-10942: In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel…
PriorityP425medium5.3CVSS 3.1
AVLACHPRLUINSUCNILAH
EPSS
0.96%
58.0th percentile
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 5.5.13-1 (bookworm) | linux 5.5.13-1 (bookworm) |
| linux | linux_kernel | < 5.5.8 | 5.5.8 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 5.5.13-1 | 5.5.13-1 |
| linux | linux_kernel | >= 0 < 4.4.0-179.209 | 4.4.0-179.209 |
| linux | linux_kernel | >= 0 < 4.15.0-99.100 | 4.15.0-99.100 |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_kernel_5.4.91-3_on_cbl_mariner_1.0 | — | — |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
nvdv2.05.4MEDIUMAV:L/AC:M/Au:N/C:N/I:P/A:C
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.3MEDIUM
vendor_msrc5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m7p8-8c8g-qwrv: In the Linux kernel before 5
ghsa_unreviewed·2022-05-24
CVE-2020-10942 [MEDIUM] CWE-119 GHSA-m7p8-8c8g-qwrv: In the Linux kernel before 5
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
Kernel
fortify: Detect struct member overflows in memcpy() at compile-time
kernel_security·2021-04-20
CVE-2019-0145 fortify: Detect struct member overflows in memcpy() at compile-time
fortify: Detect struct member overflows in memcpy() at compile-time
memcpy() is dead; long live memcpy()
tl;dr: In order to eliminate a large class of common buffer overflow
flaws that continue to persist in the kernel, have memcpy() (under
CONFIG_FORTIFY_SOURCE) perform bounds checking of the destination struct
member when they have a known size. This would have caught all of the
memcpy()-related buffer write overflow flaws identified in at least the
last three years.
Background and analysis:
While stack-based buffer overflow flaws are largely mitigated by stack
canaries (and similar) features, heap-based buffer overflow flaws continue
to regularly appear in the kernel. Many classes of heap buffer overflows
are mitigated by FORTIFY_SOURCE when using the strcpy() family of
functions, b
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
osv·2020-05-19·CVSS 7.5
CVE-2019-19060 [HIGH] linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
attacker could use this to cause a denial of service (memory exhaustion).
(CVE-2019-19060)
It was discovered that the vhost net driver in the Linux kernel contained a
stack buffer overflow. A local attacker with the ability to perform ioctl()
calls on /dev/vhost-net could use this to cause a denial of service (system
crash). (CVE-2020-10942)
It was discovered that the Serial CAN interface driver in the Linux kernel
did not properly initialize data. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-11494)
It was
OSV
linux, linux-aws, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2, linux-raspi2-5.3 vulnerabilities
osv·2020-04-30·CVSS 4.7
CVE-2020-11884 [MEDIUM] linux, linux-aws, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2, linux-raspi2-5.3 vulnerabilities
linux, linux-aws, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2, linux-raspi2-5.3 vulnerabilities
Al Viro discovered that the Linux kernel for s390x systems did not properly
perform page table upgrades for kernel sections that use secondary address
mode. A local attacker could use this to cause a denial of service (system
crash) or execute arbitrary code. (CVE-2020-11884)
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not
properly check for errors in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2019-16234)
Tristan Madani discovered that the block I/O tracing implementation in the
Linux kernel contained a race co
OSV
linux-gke-5.0, linux-oem-osp11 vulnerabilities
osv·2020-04-28·CVSS 4.7
CVE-2019-16234 [MEDIUM] linux-gke-5.0, linux-oem-osp11 vulnerabilities
linux-gke-5.0, linux-oem-osp11 vulnerabilities
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not
properly check for errors in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2019-16234)
It was discovered that the Intel WiMAX 2400 driver in the Linux kernel did
not properly deallocate memory in certain situations. A local attacker
could use this to cause a denial of service (kernel memory exhaustion).
(CVE-2019-19051)
Tristan Madani discovered that the block I/O tracing implementation in the
Linux kernel contained a race condition. A local attacker could use this to
cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2019-19768)
It was discovered that the vhost net dri
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2020-04-28·CVSS 4.7
CVE-2020-11884 [MEDIUM] linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Al Viro discovered that the Linux kernel for s390x systems did not properly
perform page table upgrades for kernel sections that use secondary address
mode. A local attacker could use this to cause a denial of service (system
crash) or execute arbitrary code. (CVE-2020-11884)
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not
properly check for errors in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2019-16234)
Tristan Madani discovered that the block I/O tracing implementation in the
Linux kernel contained a race condition. A local attack
OSV
CVE-2020-10942: In the Linux kernel before 5
osv·2020-03-24·CVSS 5.3
CVE-2020-10942 [MEDIUM] CVE-2020-10942: In the Linux kernel before 5
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-05-19·CVSS 7.5
CVE-2019-19060 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
attacker could use this to cause a denial of service (memory exhaustion).
(CVE-2019-19060)
It was discovered that the vhost net driver in the Linux kernel contained a
stack buffer overflow. A local attacker with the ability to perform ioctl()
calls on /dev/vhost-net could use this to cause a denial of service (system
crash). (CVE-2020-10942)
It was discovered that the Serial CAN interface driver in the Linux kernel
did not properly initialize data. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-11494)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-04-30·CVSS 4.7
CVE-2019-16234 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Al Viro discovered that the Linux kernel for s390x systems did not properly
perform page table upgrades for kernel sections that use secondary address
mode. A local attacker could use this to cause a denial of service (system
crash) or execute arbitrary code. (CVE-2020-11884)
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not
properly check for errors in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2019-16234)
Tristan Madani discovered that the block I/O tracing implementation in the
Linux kernel contained a race condition. A local attacker could use this to
cause a denial of service (system crash) or
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-04-28·CVSS 4.7
CVE-2019-16234 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Al Viro discovered that the Linux kernel for s390x systems did not properly
perform page table upgrades for kernel sections that use secondary address
mode. A local attacker could use this to cause a denial of service (system
crash) or execute arbitrary code. (CVE-2020-11884)
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not
properly check for errors in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2019-16234)
Tristan Madani discovered that the block I/O tracing implementation in the
Linux kernel contained a race condition. A local attacker could use this to
cause a denial of service (system crash) or
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-04-28·CVSS 4.7
CVE-2019-16234 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not
properly check for errors in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2019-16234)
It was discovered that the Intel WiMAX 2400 driver in the Linux kernel did
not properly deallocate memory in certain situations. A local attacker
could use this to cause a denial of service (kernel memory exhaustion).
(CVE-2019-19051)
Tristan Madani discovered that the block I/O tracing implementation in the
Linux kernel contained a race condition. A local attacker could use this to
cause a denial of service (system crash) or possibly expose sensitive
information. (CV
Red Hat
kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field
vendor_redhat·2020-03-22·CVSS 5.3
CVE-2020-10942 [MEDIUM] CWE-20 kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field
kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
A stack buffer overflow issue was found in the get_raw_socket() routine of the Host kernel accelerator for virtio net (vhost-net) driver. It could occur while doing an ictol(VHOST_NET_SET_BACKEND) call, and retrieving socket name in a kernel stack variable via get_raw_socket(). A user able to perform ioctl(2) calls on the '/dev/vhost-net' device may use this flaw to crash the kernel resulting in DoS issue.
Statement: This issue does not affect the kernel package as shipped with the Red Hat Enterprise Linux 5
Microsoft
In the Linux kernel before 5.5.8 get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field which might allow attackers to trigger kernel stack corruption via crafted system calls.
vendor_msrc·2020-03-10·CVSS 5.3
CVE-2020-10942 [MEDIUM] CWE-787 In the Linux kernel before 5.5.8 get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field which might allow attackers to trigger kernel stack corruption via crafted system calls.
In the Linux kernel before 5.5.8 get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field which might allow attackers to trigger kernel stack corruption via crafted system calls.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the C
Debian
CVE-2020-10942: linux - In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks va...
vendor_debian·2020·CVSS 5.3
CVE-2020-10942 [MEDIUM] CVE-2020-10942: linux - In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks va...
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
Scope: local
bookworm: resolved (fixed in 5.5.13-1)
bullseye: resolved (fixed in 5.5.13-1)
forky: resolved (fixed in 5.5.13-1)
sid: resolved (fixed in 5.5.13-1)
trixie: resolved (fixed in 5.5.13-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-10942 kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field
bugzilla·2020-03-26·CVSS 5.3
CVE-2020-10942 [MEDIUM] CVE-2020-10942 kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field
CVE-2020-10942 kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks
validation of an sk_family field, which might allow attackers to trigger kernel
stack corruption via crafted system calls.
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=42d84c8490f9f0931786f1623191fcab397c3d64
References:
https://lkml.org/lkml/2020/2/15/125
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1817719]
---
This was fixed for Fedora with the 5.5.8 stable kernel updates.
---
Statement:
This issue does not affect the kernel package as shipped with the Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.
This iss
Bugzilla
CVE-2020-10942 kernel: in get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field [fedora-all]
bugzilla·2020-03-26·CVSS 5.3
CVE-2020-10942 [MEDIUM] CVE-2020-10942 kernel: in get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field [fedora-all]
CVE-2020-10942 kernel: in get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this iss
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.htmlhttp://www.openwall.com/lists/oss-security/2020/04/15/4https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.8https://git.kernel.org/linus/42d84c8490f9f0931786f1623191fcab397c3d64https://lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00012.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlhttps://lkml.org/lkml/2020/2/15/125https://security.netapp.com/advisory/ntap-20200403-0003/https://usn.ubuntu.com/4342-1/https://usn.ubuntu.com/4344-1/https://usn.ubuntu.com/4345-1/https://usn.ubuntu.com/4364-1/https://www.debian.org/security/2020/dsa-4667https://www.debian.org/security/2020/dsa-4698http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.htmlhttp://www.openwall.com/lists/oss-security/2020/04/15/4https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.8https://git.kernel.org/linus/42d84c8490f9f0931786f1623191fcab397c3d64https://lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00012.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlhttps://lkml.org/lkml/2020/2/15/125https://security.netapp.com/advisory/ntap-20200403-0003/https://usn.ubuntu.com/4342-1/https://usn.ubuntu.com/4344-1/https://usn.ubuntu.com/4345-1/https://usn.ubuntu.com/4364-1/https://www.debian.org/security/2020/dsa-4667https://www.debian.org/security/2020/dsa-4698
2020-03-24
Published