CVE-2020-36791

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-36791
In the Linux kernel, the following vulnerability has been resolved: net_sched: keep alloc_hash updated after hash allocation In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash().

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html Third Party Advisory
https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3 Patch
https://git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2 Patch
https://git.kernel.org/stable/c/9f8b6c44be178c2498a00b270872a6e30e7c8266 Patch
https://git.kernel.org/stable/c/bd3ee8fb6371b45c71c9345cc359b94da2ddefa9 Patch
https://git.kernel.org/stable/c/c4453d2833671e3a9f6bd52f0f581056c3736386 Patch
https://git.kernel.org/stable/c/d23faf32e577922b6da20bf3740625c1105381bf Patch
https://git.kernel.org/stable/c/d6cdc5bb19b595486fb2e6661e5138d73a57f454 Patch
https://syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534 Issue Tracking
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc7:*:*:*:*:*:*
History

10 Nov 2025, 17:34

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
References () https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html - () https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html - Third Party Advisory
References () https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3 - () https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3 - Patch
References () https://git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2 - () https://git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2 - Patch
References () https://git.kernel.org/stable/c/9f8b6c44be178c2498a00b270872a6e30e7c8266 - () https://git.kernel.org/stable/c/9f8b6c44be178c2498a00b270872a6e30e7c8266 - Patch
References () https://git.kernel.org/stable/c/bd3ee8fb6371b45c71c9345cc359b94da2ddefa9 - () https://git.kernel.org/stable/c/bd3ee8fb6371b45c71c9345cc359b94da2ddefa9 - Patch
References () https://git.kernel.org/stable/c/c4453d2833671e3a9f6bd52f0f581056c3736386 - () https://git.kernel.org/stable/c/c4453d2833671e3a9f6bd52f0f581056c3736386 - Patch
References () https://git.kernel.org/stable/c/d23faf32e577922b6da20bf3740625c1105381bf - () https://git.kernel.org/stable/c/d23faf32e577922b6da20bf3740625c1105381bf - Patch
References () https://git.kernel.org/stable/c/d6cdc5bb19b595486fb2e6661e5138d73a57f454 - () https://git.kernel.org/stable/c/d6cdc5bb19b595486fb2e6661e5138d73a57f454 - Patch
References () https://syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534 - () https://syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534 - Issue Tracking
CWE CWE-125
CPE cpe:2.3:o:linux:linux_kernel:5.6:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.6:rc3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1

08 May 2025, 14:39

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: mantener alloc_hash actualizado tras la asignación de hash. En el commit 599be01ee567 ("net_sched: corregir un acceso OOB en cls_tcindex"), se movió el cálculo de cp->hash antes del primer tcindex_alloc_perfect_hash(), pero se mantuvo intacto. Esta diferencia podría provocar otro acceso fuera de los límites. cp->alloc_hash siempre debe tener el tamaño asignado; debemos actualizarlo después de este tcindex_alloc_perfect_hash().

07 May 2025, 15:15

Type Values Removed Values Added
References
  • () https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html -
  • () https://syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534 -

07 May 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-07 14:15

Updated : 2025-11-10 17:34

NVD link : CVE-2020-36791

Mitre link : CVE-2020-36791

CVE.ORG link : CVE-2020-36791

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read