CVE-2020-12465 Memory corruption in n/a
An array overflow in the Linux kernel mt76 driver allows memory corruption via oversized packets, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-12465?
CVE-2020-12465 is a medium-severity memory corruption vulnerability in Linux kernel, published on 29 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages.
Weakness: CWE-120
Which versions are affected by CVE-2020-12465?
It affects 9 products.
Products include Linux kernel, Netapp Active Iq Unified Manager, Netapp Aff Baseboard Management Controller, Netapp Cloud Backup, Netapp Hci Baseboard Management Controller, Netapp Hci Compute Node and 3 more.
How do I fix CVE-2020-12465?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-12465 being exploited?
There is no known exploitation of CVE-2020-12465 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2020-12465, GHSA-q479-f6q7-24rp, UBUNTU-CVE-2020-12465.