CVE-2020-11494 Information disclosure in n/a

Medium 4.4 Published 2 Apr 2020 Updated 8 Oct 2026

Attackers can read uninitialized kernel stack memory via the slcan driver if CONFIG_INIT_STACK_ALL is disabled, potentially exposing sensitive data.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2020-11494?

CVE-2020-11494 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 2 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka CID-b9258a2cece4.

Weakness: CWE-909, CWE-908

Which versions are affected by CVE-2020-11494?

It affects 4 products.

Products include Canonical Ubuntu Linux, Debian Debian Linux, Linux kernel, Opensuse Leap.

How do I fix CVE-2020-11494?

Apply the vendor's patch.

Is CVE-2020-11494 being exploited?

There is no known exploitation of CVE-2020-11494 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2020-11494, GHSA-64rp-89cr-p8q9, LSN-0067-1, UBUNTU-CVE-2020-11494.