CVE-2020-11725

12.04.2020, 22:15

snd_ctl_elem_add in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info->owner line, which later affects a private_size*count multiplication for unspecified "interesting side effects." NOTE: kernel engineers dispute this finding, because it could be relevant only if new callers were added that were unfamiliar with the misuse of the info->owner field to represent data unrelated to the "owner" concept. The existing callers, SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE, have been designed to misuse the info->owner field in a safe way

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 22%

Vendor	Product	Version
linux	linux_kernel	𝑥 ≤ 5.6.3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bullseye	unimportant
bullseye (security)	unimportant
bookworm	unimportant
bookworm (security)	unimportant
trixie	unimportant
sid	unimportant

Ubuntu Releases

Ubuntu Product

Codename

linux

kinetic	ignored
jammy	ignored
impish	ignored
hirsute	ignored
groovy	ignored
focal	ignored
eoan	ignored
bionic	ignored
xenial	ignored
trusty	not-affected

linux-aws

kinetic	ignored
jammy	ignored
impish	ignored
hirsute	ignored
groovy	ignored
focal	ignored
eoan	ignored
bionic	ignored
xenial	ignored
trusty	ignored

linux-aws-5.0

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-aws-5.11

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-aws-5.13

kinetic	dne
jammy	dne
impish	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-aws-5.15

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-aws-5.3

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-aws-5.4

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-aws-5.8

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-aws-hwe

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	dne
xenial	ignored
trusty	dne

linux-azure

kinetic	ignored
jammy	ignored
impish	ignored
hirsute	ignored
groovy	ignored
focal	ignored
eoan	ignored
bionic	ignored
xenial	ignored
trusty	ignored

linux-azure-4.15

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-azure-5.11

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-azure-5.13

kinetic	dne
jammy	dne
impish	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-azure-5.15

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-azure-5.3

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-azure-5.4

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-azure-5.8

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-azure-edge

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-azure-fde

kinetic	dne
jammy	ignored
impish	dne
focal	not-affected
bionic	dne
xenial	dne
trusty	dne

linux-azure-fde-5.15

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-bluefield

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-dell300x

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-fips

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	dne
bionic	dne
xenial	ignored
trusty	dne

linux-gcp

kinetic	ignored
jammy	ignored
impish	ignored
hirsute	ignored
groovy	ignored
focal	ignored
eoan	ignored
bionic	ignored
xenial	ignored
trusty	dne

linux-gcp-4.15

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gcp-5.11

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-gcp-5.13

kinetic	dne
jammy	dne
impish	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-gcp-5.15

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-gcp-5.3

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gcp-5.4

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gcp-5.8

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-gcp-edge

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gke

kinetic	dne
jammy	ignored
impish	dne
hirsute	dne
groovy	dne
focal	ignored
bionic	dne
xenial	ignored
trusty	dne

linux-gke-4.15

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gke-5.0

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gke-5.15

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-gke-5.3

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gke-5.4

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gkeop

kinetic	dne
jammy	ignored
impish	dne
hirsute	dne
groovy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-gkeop-5.4

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-hwe

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	ignored
trusty	dne

linux-hwe-5.11

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-hwe-5.13

kinetic	dne
jammy	dne
impish	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-hwe-5.15

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-hwe-5.4

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-hwe-5.8

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-hwe-edge

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	ignored
trusty	dne

linux-ibm

kinetic	ignored
jammy	ignored
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-ibm-5.4

kinetic	dne
jammy	dne
impish	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-intel-5.13

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-intel-iotg

kinetic	dne
jammy	ignored
impish	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-intel-iotg-5.15

kinetic	dne
jammy	dne
impish	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-kvm

kinetic	ignored
jammy	ignored
impish	ignored
hirsute	ignored
groovy	ignored
focal	ignored
eoan	ignored
bionic	ignored
xenial	ignored
trusty	dne

linux-lowlatency

kinetic	ignored
jammy	ignored
impish	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-lowlatency-hwe-5.15

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-lts-trusty

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	dne
xenial	dne
trusty	dne

linux-lts-xenial

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	dne
xenial	dne
trusty	ignored

linux-oem

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	ignored
bionic	ignored
xenial	ignored
trusty	dne

linux-oem-5.10

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oem-5.13

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oem-5.14

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oem-5.17

kinetic	ignored
jammy	ignored
impish	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem-5.6

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	ignored
eoan	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem-6.0

kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem-osp1

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	ignored
bionic	ignored
xenial	dne
trusty	dne

linux-oracle

kinetic	ignored
jammy	ignored
impish	ignored
hirsute	ignored
groovy	ignored
focal	ignored
eoan	ignored
bionic	ignored
xenial	ignored
trusty	dne

linux-oracle-5.0

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-oracle-5.11

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oracle-5.13

kinetic	dne
jammy	dne
impish	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oracle-5.15

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oracle-5.3

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-oracle-5.4

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-oracle-5.8

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-raspi

kinetic	ignored
jammy	ignored
impish	ignored
hirsute	ignored
groovy	ignored
focal	ignored
eoan	dne
bionic	dne
xenial	dne
trusty	dne

linux-raspi-5.4

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-raspi2

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	ignored
eoan	ignored
bionic	ignored
xenial	ignored
trusty	dne

linux-raspi2-5.3

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	dne
trusty	dne

linux-riscv

kinetic	ignored
jammy	ignored
impish	ignored
hirsute	ignored
groovy	ignored
focal	ignored
eoan	dne
bionic	dne
xenial	dne
trusty	dne

linux-riscv-5.11

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-riscv-5.8

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-snapdragon

kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
eoan	dne
bionic	ignored
xenial	ignored
trusty	dne

Known Exploits!

References

https://github.com/torvalds/linux/blob/3b2549a3740efb8af0150415737067d87e466c5b/sound/core/control.c#L1434-L1474

https://lore.kernel.org/alsa-devel/s5h4ktmlfpx.wl-tiwai%40suse.de/

https://twitter.com/yabbadabbadrew/status/1248632267028582400

https://github.com/torvalds/linux/blob/3b2549a3740efb8af0150415737067d87e466c5b/sound/core/control.c#L1434-L1474

https://lore.kernel.org/alsa-devel/s5h4ktmlfpx.wl-tiwai%40suse.de/

https://twitter.com/yabbadabbadrew/status/1248632267028582400