Linux Kernel up to 5.7.9 cgroupv2 Subsystem null pointer dereference

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.7.9. It has been rated as critical. This affects an unknown part of the component cgroupv2 Subsystem. Performing a manipulation results in null pointer dereference. This vulnerability is identified as CVE-2020-14356. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 5.7.9 (Operating System). This affects an unknown function of the component cgroupv2 Subsystem. The manipulation with an unknown input leads to a null pointer dereference vulnerability. CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.

The weakness was released 08/19/2020 as Bug 208003 as not defined bug report (Bugzilla). The advisory is shared at bugzilla.kernel.org. This vulnerability is uniquely identified as CVE-2020-14356 since 06/17/2020. An attack has to be approached locally. The successful exploitation requires a authentication. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 282234 (Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000403)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.7.10 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (282234). Entry connected to this vulnerability is available at VDB-160044. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.7.0
• 5.7.1
• 5.7.2
• 5.7.3
• 5.7.4
• 5.7.5
• 5.7.6
• 5.7.7
• 5.7.8
• 5.7.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion