CVE-2020-14314

CVE	CVE-2020-14314
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-09-15 20:15:00 UTC
Updated	2023-11-07 03:17:00 UTC
Description	A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.

Problem Types: CWE-125

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Canonical	Ubuntu Linux	14.04	All	All	All
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	20.04	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Linux	Linux Kernel	5.9.0	rc1	All	All
Operating System	Linux	Linux Kernel	5.9.0	rc1	All	All
Operating System	Linux	Linux Kernel	All	All	All	All
Application	Starwindsoftware	Starwind Virtual San	-	All	All	All
Application	Starwindsoftware	Starwind Virtual San	v8	build12533	All	All
Application	Starwindsoftware	Starwind Virtual San	v8	build12658	All	All
Application	Starwindsoftware	Starwind Virtual San	v8	build12859	All	All
Application	Starwindsoftware	Starwind Virtual San	v8	build13170	All	All
Application	Starwindsoftware	Starwind Virtual San	v8	build13586	All	All
Application	Starwindsoftware	Starwind Virtual San	v8	build13861	All	All

Reference	Source	Link	Tags
1853922 – (CVE-2020-14314) CVE-2020-14314 kernel: buffer uses out of index in ext3/4 filesystem	CONFIRM	bugzilla.redhat.com	Issue Tracking, Third Party Advisory
USN-4576-1: Linux kernel vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com
USN-4578-1: Linux kernel vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com
[SECURITY] [DLA 2420-2] linux regression update	MLIST	lists.debian.org
[PATCH 0/1] ext4: fix potential negative array index in do_split	MISC	lore.kernel.org	Vendor Advisory
kernel/git/torvalds/linux.git - Linux kernel source tree	MISC	git.kernel.org	Patch, Vendor Advisory
[SECURITY] [DLA 2385-1] linux-4.19 security update	MLIST	lists.debian.org
CVE-2020-14314 Linux Kernel vulnerability in StarWind VSAN for vSphere (VSA)	MISC	www.starwindsoftware.com
[PATCH 0/1] ext4: fix potential negative array index in do_split		lore.kernel.org
[SECURITY] [DLA 2420-1] linux security update	MLIST	lists.debian.org
USN-4579-1: Linux kernel vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

159185 Oracle Enterprise Linux Security Update for kernel (ELSA-2021-1578)
239314 Red Hat Update for kernel-rt (RHSA-2021:1739)
239339 Red Hat Update for kernel (RHSA-2021:1578)
353100 Amazon Linux Security Advisory for kernel : ALAC2012-2021-024
353101 Amazon Linux Security Advisory for kmod-mlx5 : ALAC2012-2021-025
353102 Amazon Linux Security Advisory for kmod-sfc : ALAC2012-2021-026
353135 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.4-2022-016
6140230 AWS Bottlerocket Security Update for kernel (GHSA-c8r4-764w-fh4v)
750376 OpenSUSE Security Update for RT kernel (openSUSE-SU-2021:0242-1)
900076 CBL-Mariner Linux Security Update for kernel 5.4.91
903372 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (3459)
906141 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (3459-1)
940354 AlmaLinux Security Update for kernel (ALSA-2021:1578)