In the Linux kernel, the following vulnerability has been resolved: net_sched: keep alloc_hash updated after hash allocation In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash().

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html cve-icon cve-icon
https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3 cve-icon cve-icon
https://git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2 cve-icon cve-icon
https://git.kernel.org/stable/c/9f8b6c44be178c2498a00b270872a6e30e7c8266 cve-icon cve-icon
https://git.kernel.org/stable/c/bd3ee8fb6371b45c71c9345cc359b94da2ddefa9 cve-icon cve-icon
https://git.kernel.org/stable/c/c4453d2833671e3a9f6bd52f0f581056c3736386 cve-icon cve-icon
https://git.kernel.org/stable/c/d23faf32e577922b6da20bf3740625c1105381bf cve-icon cve-icon
https://git.kernel.org/stable/c/d6cdc5bb19b595486fb2e6661e5138d73a57f454 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025050736-CVE-2020-36791-4c86@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2020-36791 cve-icon
https://syzkaller.appspot.com/bug?id=ea260693da894e7b078d18fca2c9c0a19b457534 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2020-36791 cve-icon
History

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00047}

 epss

{'score': 0.00049}

Thu, 08 May 2025 13:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 07 May 2025 14:30:00 +0000

Type Values Removed Values Added
References

Wed, 07 May 2025 13:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net_sched: keep alloc_hash updated after hash allocation In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash().
Title net_sched: keep alloc_hash updated after hash allocation
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-05-07T13:17:33.882Z

Updated: 2025-05-07T14:12:46.187Z

Reserved: 2024-02-26T17:07:27.435Z

Link: CVE-2020-36791

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-05-07T14:15:28.513

Modified: 2025-05-08T14:39:18.800

Link: CVE-2020-36791

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-05-07T00:00:00Z

Links: CVE-2020-36791 - Bugzilla