CVE-2020-9383 (High) detected in linux-stable-rtv4.1

[mend-bolt-for-github[bot]]

CVE-2020-9383 - High Severity Vulnerability

Vulnerable Library - linux-stable-rtv4.1

Library home page: https://git.kernel.org/pub/scm/linux/kernel/git/zanussi/linux-stable-rt.git

Found in HEAD commit: 9cafd1b39d091c76656512d15c90a6952f088074

Found in base branch: master

Vulnerable Source Files (2)

/drivers/block/floppy.c /drivers/block/floppy.c

Vulnerability Details

An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2.

Publish Date: 2020-02-25

URL: CVE-2020-9383

CVSS 3 Score Details (7.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.linuxkernelcves.com/cves/CVE-2020-9383

Release Date: 2020-02-25

Fix Resolution: v5.6-rc4,v3.16.83,v4.14.172,v4.19.107,v4.4.215,v4.9.215,v5.4.23,v5.5.7

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.