UBUNTU-CVE-2020-9391
- Source
- https://ubuntu.com/security/CVE-2020-9391
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-9391.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2020-9391
- Upstream
- Published
- 2020-02-25T18:15:00Z
- Modified
- 2025-07-18T16:45:46Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation.
- References
-
- https://ubuntu.com/security/CVE-2020-9391
- https://git.kernel.org/linus/dcde237319e626d1ec3c9d8b7613032f0fd4663a
- http://www.openwall.com/lists/oss-security/2020/02/25/6
- https://bugzilla.redhat.com/show_bug.cgi?id=1797052
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dcde237319e626d1ec3c9d8b7613032f0fd4663a
- https://www.cve.org/CVERecord?id=CVE-2020-9391
Affected packages
Ubuntu:Pro:16.04:LTS / linux-hwe-edge
Package
- Name
- linux-hwe-edge
- Purl
- pkg:deb/ubuntu/linux-hwe-edge@4.15.0-23.25~16.04.1?arch=source&distro=esm-infra/xenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
4.*
4.8.0-28.30~16.04.1
4.8.0-30.32~16.04.1
4.8.0-32.34~16.04.1
4.8.0-34.36~16.04.1
4.10.0-14.16~16.04.1
4.10.0-19.21~16.04.1
4.10.0-20.22~16.04.1
4.10.0-21.23~16.04.1
4.10.0-22.24~16.04.1
4.10.0-24.28~16.04.1
4.10.0-26.30~16.04.1
4.11.0-13.19~16.04.1
4.11.0-14.20~16.04.1
4.13.0-16.19~16.04.3
4.13.0-17.20~16.04.1
4.13.0-19.22~16.04.1
4.13.0-21.24~16.04.1
4.13.0-25.29~16.04.2
4.15.0-13.14~16.04.1
4.15.0-15.16~16.04.1
4.15.0-20.21~16.04.1
4.15.0-22.24~16.04.1
4.15.0-23.25~16.04.1
Ubuntu:Pro:18.04:LTS / linux-azure-edge
Package
- Name
- linux-azure-edge
- Purl
- pkg:deb/ubuntu/linux-azure-edge@5.0.0-1012.12~18.04.2?arch=source&distro=esm-infra/bionic
Ubuntu:Pro:18.04:LTS / linux-gcp-edge
Package
- Name
- linux-gcp-edge
- Purl
- pkg:deb/ubuntu/linux-gcp-edge@5.0.0-1013.13~18.04.1?arch=source&distro=esm-infra/bionic
Ubuntu:Pro:18.04:LTS / linux-hwe-edge
Package
- Name
- linux-hwe-edge
- Purl
- pkg:deb/ubuntu/linux-hwe-edge@5.3.0-24.26~18.04.2?arch=source&distro=esm-infra/bionic