Bug 716640

Summary:	sys-kernel/gentoo-sources: Unspecified vulnerability (CVE-2020-9391)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kernel
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2020-04-08 05:12:44 UTC

CVE-2020-9391 (https://nvd.nist.gov/vuln/detail/CVE-2020-9391):
  An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the
  AArch64 architecture. It ignores the top byte in the address passed to the
  brk system call, potentially moving the memory break downwards when the
  application expects it to move upwards, aka CID-dcde237319e6. This has been
  observed to cause heap corruption with the GNU C Library malloc
  implementation.


This is for arm kernel.

Comment 1 John Helmert III archtester

2021-06-12 16:04:46 UTC

Looks like all modern LTS/stable versions have some version of the patch from the oss-security mail or are unaffected.