Lucene search

K
redhatcveRedhat.comRH:CVE-2020-36766
HistorySep 22, 2023 - 8:54 a.m.

CVE-2020-36766

2023-09-2208:54:16
redhat.com
access.redhat.com
14
flaw
kernel memory leak
local attacker
unprivileged users
blacklist mechanism

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

9.1%

A flaw was found in cec_adap_g_log_addrs in drivers/media/cec/core/cec-api.c in the Linux Kernel. This issue may allow a local attacker to leak one byte of kernel memory on specific hardware to unprivileged users, directly assigning log_addrs with a hole in the structure, causing a kernel information leak problem.

Mitigation

Mitigation for this issue is to skip loading the affected module HDMI Consumer Electronics Control framework driver "cec" onto the system until we have a fix available. This can be done by a blacklist mechanism, which will ensure the driver is not loaded at the boot time.

How do I blacklist a kernel module to prevent it from loading automatically?  
https://access.redhat.com/solutions/41278   

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

9.1%