CVE-2020-12656

 

Published at: - 05-05-2020 08:15

Last modified: - 26-10-2022 01:44

Total changes: - 5

Description

** DISPUTED ** gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a problem that on unloading a specific kernel module some memory is leaked, but loading kernel modules is a privileged operation. A user could also write a kernel module to consume any amount of memory they like and load that replicating the effect of this bug.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://bugzilla.kernel.org/show_bug.cgi?id=206651
• openSUSE-SU-2020:0801-Mailing List, Third Party Advisory
• openSUSE-SU-2020:0935-Mailing List, Third Party Advisory
• USN-4483-1-Third Party Advisory
• USN-4485-1-Third Party Advisory

 

Keywords

NVD

 

CVE-2020-12656

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures