CVEvulnerability

CVE-2020-9391

5.5 MEDIUM Published 2020-02-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-02-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-787

Description

An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation.

Affected configurations

• linux linux kernel (>= 5.5 <= 5.5.6) • linux linux kernel 5.4 • fedoraproject fedora 31 • netapp active iq unified manager • netapp cloud backup • netapp data availability services • netapp hci management node • netapp solidfire • netapp steelstore cloud integrated storage • netapp h410c firmware

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References