Integer Overflow or Wraparound Affecting kernel-debug-modules-extra package, versions <0:4.18.0-372.9.1.el8
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ROCKY8-KERNELDEBUGMODULESEXTRA-3191575
- published 5 Jan 2023
- disclosed 9 Jun 2020
Introduced: 9 Jun 2020
CVE-2020-13974 Open this link in a new tabHow to fix?
Upgrade Rocky-Linux:8
kernel-debug-modules-extra
to version 0:4.18.0-372.9.1.el8 or higher.
This issue was patched in RLSA-2022:1988
.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-debug-modules-extra
package and not the kernel-debug-modules-extra
package as distributed by Rocky-Linux
.
See How to fix?
for Rocky-Linux:8
relevant fixed versions and status.
An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13974
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-13974.json
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=dad0bf9ce93fa40b667eccd3306783f4db4b932b
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b86dab054059b970111b5516ae548efaae5b3aae
- https://lists.debian.org/debian-lts-announce/2020/08/msg00019.html
- https://lkml.org/lkml/2020/3/22/482
- https://usn.ubuntu.com/4427-1/
- https://usn.ubuntu.com/4439-1/
- https://usn.ubuntu.com/4440-1/
- https://usn.ubuntu.com/4483-1/
- https://usn.ubuntu.com/4485-1/
- https://www.oracle.com/security-alerts/cpujul2022.html