CVE-2020-11725

EUVD-2020-4067
snd_ctl_elem_add in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info->owner line, which later affects a private_size*count multiplication for unspecified "interesting side effects." NOTE: kernel engineers dispute this finding, because it could be relevant only if new callers were added that were unfamiliar with the misuse of the info->owner field to represent data unrelated to the "owner" concept. The existing callers, SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE, have been designed to misuse the info->owner field in a safe way
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 31%
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
𝑥
≤ 5.6.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bookworm
unimportant
bookworm (security)
unimportant
bullseye
unimportant
bullseye (security)
unimportant
sid
unimportant
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
bionic
ignored
eoan
ignored
focal
ignored
groovy
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
not-affected
xenial
ignored
linux-aws
bionic
ignored
eoan
ignored
focal
ignored
groovy
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
ignored
xenial
ignored
linux-aws-5.0
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.13
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.3
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.4
bionic
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-5.8
bionic
dne
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-aws-hwe
bionic
dne
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-azure
bionic
ignored
eoan
ignored
focal
ignored
groovy
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
ignored
xenial
ignored
linux-azure-4.15
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.13
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.3
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.4
bionic
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-5.8
bionic
dne
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-edge
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-azure-fde
bionic
dne
focal
not-affected
impish
dne
jammy
ignored
kinetic
dne
trusty
dne
xenial
dne
linux-azure-fde-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-bluefield
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-dell300x
bionic
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-fips
bionic
dne
focal
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-gcp
bionic
ignored
eoan
ignored
focal
ignored
groovy
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
dne
xenial
ignored
linux-gcp-4.15
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.13
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.3
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.4
bionic
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-5.8
bionic
dne
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gcp-edge
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gke
bionic
dne
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
ignored
kinetic
dne
trusty
dne
xenial
ignored
linux-gke-4.15
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gke-5.0
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gke-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gke-5.3
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gke-5.4
bionic
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-gkeop
bionic
dne
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
ignored
kinetic
dne
trusty
dne
xenial
dne
linux-gkeop-5.4
bionic
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-hwe-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe-5.13
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe-5.4
bionic
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe-5.8
bionic
dne
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-hwe-edge
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-ibm
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
ignored
kinetic
ignored
trusty
dne
xenial
dne
linux-ibm-5.4
bionic
ignored
focal
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-intel-5.13
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-intel-iotg
bionic
dne
focal
dne
impish
dne
jammy
ignored
kinetic
dne
trusty
dne
xenial
dne
linux-intel-iotg-5.15
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-kvm
bionic
ignored
eoan
ignored
focal
ignored
groovy
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
dne
xenial
ignored
linux-lowlatency
bionic
dne
focal
dne
impish
dne
jammy
ignored
kinetic
ignored
trusty
dne
xenial
dne
linux-lowlatency-hwe-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-lts-trusty
bionic
dne
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-lts-xenial
bionic
dne
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
ignored
xenial
dne
linux-oem
bionic
ignored
eoan
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-oem-5.10
bionic
dne
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oem-5.13
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oem-5.14
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oem-5.17
bionic
dne
focal
dne
impish
dne
jammy
ignored
kinetic
ignored
trusty
dne
xenial
dne
linux-oem-5.6
bionic
dne
eoan
dne
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oem-6.0
bionic
dne
focal
dne
jammy
ignored
kinetic
dne
trusty
dne
xenial
dne
linux-oem-osp1
bionic
ignored
eoan
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle
bionic
ignored
eoan
ignored
focal
ignored
groovy
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
dne
xenial
ignored
linux-oracle-5.0
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.13
bionic
dne
focal
ignored
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.15
bionic
dne
focal
ignored
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.3
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.4
bionic
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-oracle-5.8
bionic
dne
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-raspi
bionic
dne
eoan
dne
focal
ignored
groovy
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
dne
xenial
dne
linux-raspi-5.4
bionic
ignored
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-raspi2
bionic
ignored
eoan
ignored
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
linux-raspi2-5.3
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-riscv
bionic
dne
eoan
dne
focal
ignored
groovy
ignored
hirsute
ignored
impish
ignored
jammy
ignored
kinetic
ignored
trusty
dne
xenial
dne
linux-riscv-5.11
bionic
dne
focal
ignored
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-riscv-5.8
bionic
dne
focal
ignored
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
dne
linux-snapdragon
bionic
ignored
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
trusty
dne
xenial
ignored
References
https://github.com/torvalds/linux/blob/3b2549a3740efb8af0150415737067d87e466c5b/sound/core/control.c#L1434-L1474
https://lore.kernel.org/alsa-devel/s5h4ktmlfpx.wl-tiwai%40suse.de/
https://twitter.com/yabbadabbadrew/status/1248632267028582400
https://github.com/torvalds/linux/blob/3b2549a3740efb8af0150415737067d87e466c5b/sound/core/control.c#L1434-L1474
https://lore.kernel.org/alsa-devel/s5h4ktmlfpx.wl-tiwai%40suse.de/
https://twitter.com/yabbadabbadrew/status/1248632267028582400