cbcvebase.
CVE-2020-36776
published 2024-02-27

CVE-2020-36776: In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/cpufreq_cooling: Fix slab OOB issue Slab OOB issue is scanned by KASAN in…

PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.23%
14.1th percentile
In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/cpufreq_cooling: Fix slab OOB issue Slab OOB issue is scanned by KASAN in cpu_power_to_freq(). If power is limited below the power of OPP0 in EM table, it will cause slab out-of-bound issue with negative array index. Return the lowest frequency if limited power cannot found a suitable OPP in EM table to fix this issue. Backtrace: [] die+0x104/0x5ac [] bug_handler+0x64/0xd0 [] brk_handler+0x160/0x258 [] do_debug_exception+0x248/0x3f0 [] el1_dbg+0x14/0xbc [] __kasan_report+0x1dc/0x1e0 [] kasan_report+0x10/0x20 [] __asan_report_load8_noabort+0x18/0x28 [] cpufreq_power2state+0x180/0x43c [] power_actor_set_power+0x114/0x1d4 [] allocate_power+0xaec/0xde0 [] power_allocator_throttle+0x3ec/0x5a4 [] handle_thermal_trip+0x160/0x294 [] thermal_zone_device_check+0xe4/0x154 [] process_one_work+0x5e4/0xe28 [] worker_thread+0xa4c/0xfac [] kthread+0x33c/0x358 [] ret_from_fork+0xc/0x18

Affected

21 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.10.38-1 (bookworm)linux 5.10.38-1 (bookworm)
linuxlinux——
linuxlinux——
linuxlinux——
linuxlinux——
linuxlinux——
linuxlinux>= 371a3bc79c11b707d7a1b7a2c938dc3cc042fffb < c24a20912eef00587416628149c438e885eb1304c24a20912eef00587416628149c438e885eb1304
linuxlinux>= 371a3bc79c11b707d7a1b7a2c938dc3cc042fffb < 876a5f33e5d961d879c5436987c09b3d9ef70379876a5f33e5d961d879c5436987c09b3d9ef70379
linuxlinux>= 371a3bc79c11b707d7a1b7a2c938dc3cc042fffb < 6bf443acf6ca4f666d0e4225614ba9993a3aa1a96bf443acf6ca4f666d0e4225614ba9993a3aa1a9
linuxlinux>= 371a3bc79c11b707d7a1b7a2c938dc3cc042fffb < 34ab17cc6c2c1ac93d7e5d53bb972df9a968f08534ab17cc6c2c1ac93d7e5d53bb972df9a968f085
linuxlinux>= 4.14.189 < 4.154.15
linuxlinux>= 4.19.134 < 4.204.20
linuxlinux>= 5.4.53 < 5.55.5
linuxlinux>= 5.7.8 < 5.85.8
linuxlinux_kernel>= 0 < 5.10.38-15.10.38-1
linuxlinux_kernel>= 0 < 5.10.38-15.10.38-1
linuxlinux_kernel>= 0 < 5.10.38-15.10.38-1
linuxlinux_kernel>= 0 < 5.10.38-15.10.38-1
linuxlinux_kernel>= 5.11.0 < 5.11.205.11.20
linuxlinux_kernel>= 5.12.0 < 5.12.35.12.3
linuxlinux_kernel>= 5.8.0 < 5.10.365.10.36

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.