CVE-2020-14304

A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality.

CVSS v3 4.4 MEDIUM
CVSS v2.0 2.1 LOW

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=960702	Issue Tracking Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14304	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel:4.9.210-1:::::::*
	cpe:2.3:o:linux:linux_kernel:4.19.118-2:::::::*
	cpe:2.3:o:linux:linux_kernel:5.6.7-1:::::::*

History

12 Feb 2023, 22:15

Type	Values Removed	Values Added
CWE	~~CWE-755~~	CWE-460

Information

Published : 2020-09-15 20:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-14304

Mitre link : CVE-2020-14304

CVE.ORG link : CVE-2020-14304

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-460

Improper Cleanup on Thrown Exception

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2020-14304", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2020-09-15T20:15:13.103", "references": [{"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=960702", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14304", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-460"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo de divulgaci\u00f3n de la memoria en los controladores ethernet del kernel de Linux, en la manera en que lee los datos de la EEPROM del dispositivo. Este fallo permite a un usuario local leer valores no inicializados desde la memoria del kernel. La mayor amenaza de esta vulnerabilidad es la confidencialidad"}], "lastModified": "2023-02-12T22:15:16.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:4.9.210-1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F1D61EE-76CD-417A-807A-5DE23D3663E7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.19.118-2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75B072C1-407D-447C-BC94-FF78155BC628"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.6.7-1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF89DFE3-4A07-4106-88EB-3D5D59480B5A"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}