CVE-2020-14386

MEDIUM LAB

Linux Kernel < 4.9.239 - Out-of-Bounds Write

Title source: rule

Description

A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.

Exploits (1)

nomisec WORKING POC 43 stars

by cgwalters · poc

https://github.com/cgwalters/cve-2020-14386

View Code ZIP pw:eip

References (12)

[Mailing List, Patch, Third Party Advisory] https://seclists.org/oss-sec/2020/q3/146

[Issue Tracking, Patch, Third Party Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14386

[Patch, Vendor Advisory] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=acf69c946233259ab4d64f8869d4037a198c7f06

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNCPXERMUHPSGF6S2VVFL5NVVPBBFB63/

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html

[Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2021/09/17/2

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2021/09/17/4

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2021/09/21/1

Scores

CVSS v3 6.7

EPSS 0.0063

EPSS Percentile 70.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Lab Environment

COMMUNITY

Community Lab

docker pull registry.svc.ci.openshift.org/coreos/cosa-buildroot

https://github.com/cgwalters/cve-2020-14386

View in Library

Details

CWE

CWE-250 CWE-787

Status published

Products (5)

debian/debian_linux 9.0

fedoraproject/fedora 33

linux/linux_kernel 5.9.0 rc1 (3 CPE variants)

linux/linux_kernel 4.6 - 4.9.239

opensuse/leap 15.1

Published Sep 16, 2020

Tracked Since Feb 18, 2026