CVE-2020-11668

Upstream information

CVE-2020-11668 at MITRE

Description

In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.

---

SUSE information

Overall state of this security issue: Running

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	5.6
Vector	AV:L/AC:L/Au:N/C:N/I:P/A:C
Access Vector	Local
Access Complexity	Low
Authentication	None
Confidentiality Impact	None
Integrity Impact	Partial
Availability Impact	Complete

CVSS v3 Scores

	National Vulnerability Database	SUSE
Base Score	7.1	7.1
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Access Vector	Local	Local
Access Complexity	Low	Low
Privileges Required	Low	Low
User Interaction	None	None
Scope	Unchanged	Unchanged
Confidentiality Impact	None	None
Integrity Impact	High	High
Availability Impact	High	High
CVSSv3 Version	3.1	3.1

SUSE Bugzilla entries: 1168952 [IN_PROGRESS], 1173942 [IN_PROGRESS]

SUSE Security Advisories:

• SUSE-SU-2020:2491-1, published Fri Sep 4 10:33:27 MDT 2020
• SUSE-SU-2020:2492-1, published Fri Sep 4 10:25:03 MDT 2020
• SUSE-SU-2020:2497-1, published Fri Sep 4 10:28:26 MDT 2020
• SUSE-SU-2020:2498-1, published Fri Sep 4 10:37:18 MDT 2020
• SUSE-SU-2020:2499-1, published Fri Sep 4 10:27:28 MDT 2020
• SUSE-SU-2020:2502-1, published Fri Sep 4 10:23:57 MDT 2020
• SUSE-SU-2020:2505-1, published Fri Sep 4 10:18:36 MDT 2020
• SUSE-SU-2020:2506-1, published Fri Sep 4 10:16:57 MDT 2020
• SUSE-SU-2020:2507-1, published Fri Sep 4 10:20:13 MDT 2020
• SUSE-SU-2020:2513-1, published Fri Sep 4 10:22:34 MDT 2020
• SUSE-SU-2020:2524-1, published Fri Sep 4 10:21:24 MDT 2020
• SUSE-SU-2020:2525-1, published Fri Sep 4 10:15:58 MDT 2020
• SUSE-SU-2020:2526-1, published Fri Sep 4 10:29:57 MDT 2020
• SUSE-SU-2020:2531-1, published Fri Sep 4 10:14:51 MDT 2020

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Live Patching 12 SP4	kgraft-patch-4_12_14-95_32-default >= 8-2.2 kgraft-patch-4_12_14-95_37-default >= 7-2.2 kgraft-patch-4_12_14-95_40-default >= 6-2.2 kgraft-patch-4_12_14-95_45-default >= 6-2.2 kgraft-patch-4_12_14-95_48-default >= 5-2.2 kgraft-patch-SLE12-SP4_Update_10 >= 6-2.2 kgraft-patch-SLE12-SP4_Update_11 >= 6-2.2 kgraft-patch-SLE12-SP4_Update_12 >= 5-2.2 kgraft-patch-SLE12-SP4_Update_8 >= 8-2.2 kgraft-patch-SLE12-SP4_Update_9 >= 7-2.2	Patchnames: SUSE-SLE-Live-Patching-12-SP4-2020-2503 SUSE-SLE-Live-Patching-12-SP4-2020-2504 SUSE-SLE-Live-Patching-12-SP4-2020-2505 SUSE-SLE-Live-Patching-12-SP4-2020-2506 SUSE-SLE-Live-Patching-12-SP4-2020-2507
SUSE Linux Enterprise Live Patching 12 SP5	kgraft-patch-4_12_14-120-default >= 6-15.2 kgraft-patch-4_12_14-122_12-default >= 6-2.2 kgraft-patch-4_12_14-122_17-default >= 5-2.2 kgraft-patch-4_12_14-122_7-default >= 6-2.2 kgraft-patch-SLE12-SP5_Update_0 >= 6-15.2 kgraft-patch-SLE12-SP5_Update_1 >= 6-2.2 kgraft-patch-SLE12-SP5_Update_2 >= 6-2.2 kgraft-patch-SLE12-SP5_Update_3 >= 5-2.2	Patchnames: SUSE-SLE-Live-Patching-12-SP5-2020-2511 SUSE-SLE-Live-Patching-12-SP5-2020-2512 SUSE-SLE-Live-Patching-12-SP5-2020-2513 SUSE-SLE-Live-Patching-12-SP5-2020-2514
SUSE Linux Enterprise Module for Live Patching 15 SP1	kernel-livepatch-4_12_14-197_18-default >= 8-2.2 kernel-livepatch-4_12_14-197_21-default >= 8-2.2 kernel-livepatch-4_12_14-197_26-default >= 6-2.2 kernel-livepatch-4_12_14-197_29-default >= 6-2.2 kernel-livepatch-4_12_14-197_34-default >= 5-2.2 kernel-livepatch-4_12_14-197_37-default >= 5-2.2 kernel-livepatch-SLE15-SP1_Update_10 >= 5-2.2 kernel-livepatch-SLE15-SP1_Update_5 >= 8-2.2 kernel-livepatch-SLE15-SP1_Update_6 >= 8-2.2 kernel-livepatch-SLE15-SP1_Update_7 >= 6-2.2 kernel-livepatch-SLE15-SP1_Update_8 >= 6-2.2 kernel-livepatch-SLE15-SP1_Update_9 >= 5-2.2	Patchnames: SUSE-SLE-Module-Live-Patching-15-SP1-2020-2526 SUSE-SLE-Module-Live-Patching-15-SP1-2020-2527 SUSE-SLE-Module-Live-Patching-15-SP1-2020-2528 SUSE-SLE-Module-Live-Patching-15-SP1-2020-2529 SUSE-SLE-Module-Live-Patching-15-SP1-2020-2530 SUSE-SLE-Module-Live-Patching-15-SP1-2020-2531
SUSE Linux Enterprise Module for Live Patching 15	kernel-livepatch-4_12_14-150_35-default >= 8-2.2 kernel-livepatch-4_12_14-150_38-default >= 8-2.2 kernel-livepatch-4_12_14-150_41-default >= 6-2.2 kernel-livepatch-4_12_14-150_47-default >= 6-2.2 kernel-livepatch-4_12_14-150_52-default >= 2-2.2 kernel-livepatch-4_12_14-150_55-default >= 2-2.2 kernel-livepatch-SLE15_Update_14 >= 8-2.2 kernel-livepatch-SLE15_Update_15 >= 8-2.2 kernel-livepatch-SLE15_Update_16 >= 6-2.2 kernel-livepatch-SLE15_Update_17 >= 6-2.2 kernel-livepatch-SLE15_Update_18 >= 2-2.2 kernel-livepatch-SLE15_Update_19 >= 2-2.2	Patchnames: SUSE-SLE-Module-Live-Patching-15-2020-2520 SUSE-SLE-Module-Live-Patching-15-2020-2521 SUSE-SLE-Module-Live-Patching-15-2020-2522 SUSE-SLE-Module-Live-Patching-15-2020-2523 SUSE-SLE-Module-Live-Patching-15-2020-2524 SUSE-SLE-Module-Live-Patching-15-2020-2525
SUSE Linux Enterprise Server 12 SP2-ESPOS SUSE Linux Enterprise Server for SAP Applications 12 SP2-ESPOS	kgraft-patch-4_4_121-92_120-default >= 9-2.2 kgraft-patch-4_4_121-92_125-default >= 7-2.2 kgraft-patch-4_4_121-92_129-default >= 4-2.2 kgraft-patch-4_4_121-92_135-default >= 2-2.2 kgraft-patch-4_4_121-92_138-default >= 2-2.2 kgraft-patch-SLE12-SP2_Update_32 >= 9-2.2 kgraft-patch-SLE12-SP2_Update_33 >= 7-2.2 kgraft-patch-SLE12-SP2_Update_34 >= 4-2.2 kgraft-patch-SLE12-SP2_Update_35 >= 2-2.2 kgraft-patch-SLE12-SP2_Update_36 >= 2-2.2	Patchnames: SUSE-SLE-SERVER-12-SP2-ESPOS-2020-2491 SUSE-SLE-SERVER-12-SP2-ESPOS-2020-2492 SUSE-SLE-SERVER-12-SP2-ESPOS-2020-2493 SUSE-SLE-SERVER-12-SP2-ESPOS-2020-2494 SUSE-SLE-SERVER-12-SP2-ESPOS-2020-2495
SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP2-LTSS	kgraft-patch-4_4_121-92_120-default >= 9-2.2 kgraft-patch-4_4_121-92_125-default >= 7-2.2 kgraft-patch-4_4_121-92_129-default >= 4-2.2 kgraft-patch-4_4_121-92_135-default >= 2-2.2 kgraft-patch-4_4_121-92_138-default >= 2-2.2 kgraft-patch-SLE12-SP2_Update_32 >= 9-2.2 kgraft-patch-SLE12-SP2_Update_33 >= 7-2.2 kgraft-patch-SLE12-SP2_Update_34 >= 4-2.2 kgraft-patch-SLE12-SP2_Update_35 >= 2-2.2 kgraft-patch-SLE12-SP2_Update_36 >= 2-2.2	Patchnames: SUSE-SLE-SERVER-12-SP2-2020-2491 SUSE-SLE-SERVER-12-SP2-2020-2492 SUSE-SLE-SERVER-12-SP2-2020-2493 SUSE-SLE-SERVER-12-SP2-2020-2494 SUSE-SLE-SERVER-12-SP2-2020-2495
SUSE Linux Enterprise Server 12 SP3-ESPOS SUSE Linux Enterprise Server for SAP Applications 12 SP3-ESPOS	kgraft-patch-4_4_180-94_103-default >= 9-2.2 kgraft-patch-4_4_180-94_107-default >= 7-2.2 kgraft-patch-4_4_180-94_113-default >= 6-2.2 kgraft-patch-4_4_180-94_116-default >= 3-2.2 kgraft-patch-4_4_180-94_121-default >= 2-2.2 kgraft-patch-4_4_180-94_124-default >= 2-2.2 kgraft-patch-4_4_180-94_127-default >= 2-2.2 kgraft-patch-SLE12-SP3_Update_28 >= 9-2.2 kgraft-patch-SLE12-SP3_Update_29 >= 7-2.2 kgraft-patch-SLE12-SP3_Update_30 >= 6-2.2 kgraft-patch-SLE12-SP3_Update_31 >= 3-2.2 kgraft-patch-SLE12-SP3_Update_32 >= 2-2.2 kgraft-patch-SLE12-SP3_Update_33 >= 2-2.2 kgraft-patch-SLE12-SP3_Update_34 >= 2-2.2	Patchnames: SUSE-SLE-SERVER-12-SP3-ESPOS-2020-2496 SUSE-SLE-SERVER-12-SP3-ESPOS-2020-2497 SUSE-SLE-SERVER-12-SP3-ESPOS-2020-2498 SUSE-SLE-SERVER-12-SP3-ESPOS-2020-2499 SUSE-SLE-SERVER-12-SP3-ESPOS-2020-2500 SUSE-SLE-SERVER-12-SP3-ESPOS-2020-2501 SUSE-SLE-SERVER-12-SP3-ESPOS-2020-2502
SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP3-LTSS	kgraft-patch-4_4_180-94_103-default >= 9-2.2 kgraft-patch-4_4_180-94_107-default >= 7-2.2 kgraft-patch-4_4_180-94_113-default >= 6-2.2 kgraft-patch-4_4_180-94_116-default >= 3-2.2 kgraft-patch-4_4_180-94_121-default >= 2-2.2 kgraft-patch-4_4_180-94_124-default >= 2-2.2 kgraft-patch-4_4_180-94_127-default >= 2-2.2 kgraft-patch-SLE12-SP3_Update_28 >= 9-2.2 kgraft-patch-SLE12-SP3_Update_29 >= 7-2.2 kgraft-patch-SLE12-SP3_Update_30 >= 6-2.2 kgraft-patch-SLE12-SP3_Update_31 >= 3-2.2 kgraft-patch-SLE12-SP3_Update_32 >= 2-2.2 kgraft-patch-SLE12-SP3_Update_33 >= 2-2.2 kgraft-patch-SLE12-SP3_Update_34 >= 2-2.2	Patchnames: SUSE-SLE-SERVER-12-SP3-2020-2496 SUSE-SLE-SERVER-12-SP3-2020-2497 SUSE-SLE-SERVER-12-SP3-2020-2498 SUSE-SLE-SERVER-12-SP3-2020-2499 SUSE-SLE-SERVER-12-SP3-2020-2500 SUSE-SLE-SERVER-12-SP3-2020-2501 SUSE-SLE-SERVER-12-SP3-2020-2502
SUSE Linux Enterprise Server for SAP Applications 12 SP2	kgraft-patch-4_4_121-92_120-default >= 9-2.2 kgraft-patch-4_4_121-92_125-default >= 7-2.2 kgraft-patch-4_4_121-92_129-default >= 4-2.2 kgraft-patch-4_4_121-92_135-default >= 2-2.2 kgraft-patch-4_4_121-92_138-default >= 2-2.2 kgraft-patch-SLE12-SP2_Update_32 >= 9-2.2 kgraft-patch-SLE12-SP2_Update_33 >= 7-2.2 kgraft-patch-SLE12-SP2_Update_34 >= 4-2.2 kgraft-patch-SLE12-SP2_Update_35 >= 2-2.2 kgraft-patch-SLE12-SP2_Update_36 >= 2-2.2	Patchnames: SUSE-SLE-SAP-12-SP2-2020-2491 SUSE-SLE-SAP-12-SP2-2020-2492 SUSE-SLE-SAP-12-SP2-2020-2493 SUSE-SLE-SAP-12-SP2-2020-2494 SUSE-SLE-SAP-12-SP2-2020-2495
SUSE Linux Enterprise Server for SAP Applications 12 SP3	kgraft-patch-4_4_180-94_103-default >= 9-2.2 kgraft-patch-4_4_180-94_107-default >= 7-2.2 kgraft-patch-4_4_180-94_113-default >= 6-2.2 kgraft-patch-4_4_180-94_116-default >= 3-2.2 kgraft-patch-4_4_180-94_121-default >= 2-2.2 kgraft-patch-4_4_180-94_124-default >= 2-2.2 kgraft-patch-4_4_180-94_127-default >= 2-2.2 kgraft-patch-SLE12-SP3_Update_28 >= 9-2.2 kgraft-patch-SLE12-SP3_Update_29 >= 7-2.2 kgraft-patch-SLE12-SP3_Update_30 >= 6-2.2 kgraft-patch-SLE12-SP3_Update_31 >= 3-2.2 kgraft-patch-SLE12-SP3_Update_32 >= 2-2.2 kgraft-patch-SLE12-SP3_Update_33 >= 2-2.2 kgraft-patch-SLE12-SP3_Update_34 >= 2-2.2	Patchnames: SUSE-SLE-SAP-12-SP3-2020-2496 SUSE-SLE-SAP-12-SP3-2020-2497 SUSE-SLE-SAP-12-SP3-2020-2498 SUSE-SLE-SAP-12-SP3-2020-2499 SUSE-SLE-SAP-12-SP3-2020-2500 SUSE-SLE-SAP-12-SP3-2020-2501 SUSE-SLE-SAP-12-SP3-2020-2502

List of packages in QA

Product(s)	Package(s)
SUSE Linux Enterprise Module for Live Patching 15	kernel-livepatch-4_12_14-150_58-default >= 2-2.1 kernel-livepatch-4_12_14-150_58-default-debuginfo >= 2-2.1 kernel-livepatch-SLE15_Update_20 >= 2-2.1
SUSE Linux Enterprise Server 12 SP2-ESPOS	kgraft-patch-4_4_121-92_141-default >= 2-2.1 kgraft-patch-SLE12-SP2_Update_37 >= 2-2.1
SUSE Linux Enterprise Server 12 SP2-LTSS	kgraft-patch-4_4_121-92_141-default >= 2-2.1 kgraft-patch-SLE12-SP2_Update_37 >= 2-2.1
SUSE Linux Enterprise Server 12 SP3-ESPOS	kgraft-patch-4_4_180-94_130-default >= 2-2.1 kgraft-patch-4_4_180-94_130-default-debuginfo >= 2-2.1 kgraft-patch-SLE12-SP3_Update_35 >= 2-2.1
SUSE Linux Enterprise Server 12 SP3-LTSS	kgraft-patch-4_4_180-94_130-default >= 2-2.1 kgraft-patch-4_4_180-94_130-default-debuginfo >= 2-2.1 kgraft-patch-SLE12-SP3_Update_35 >= 2-2.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2	kgraft-patch-4_4_121-92_141-default >= 2-2.1 kgraft-patch-SLE12-SP2_Update_37 >= 2-2.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2-ESPOS	kgraft-patch-4_4_121-92_141-default >= 2-2.1 kgraft-patch-SLE12-SP2_Update_37 >= 2-2.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2-LTSS	kgraft-patch-4_4_121-92_141-default >= 2-2.1 kgraft-patch-SLE12-SP2_Update_37 >= 2-2.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3	kgraft-patch-4_4_180-94_130-default >= 2-2.1 kgraft-patch-4_4_180-94_130-default-debuginfo >= 2-2.1 kgraft-patch-SLE12-SP3_Update_35 >= 2-2.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3-ESPOS	kgraft-patch-4_4_180-94_130-default >= 2-2.1 kgraft-patch-4_4_180-94_130-default-debuginfo >= 2-2.1 kgraft-patch-SLE12-SP3_Update_35 >= 2-2.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3-LTSS	kgraft-patch-4_4_180-94_130-default >= 2-2.1 kgraft-patch-4_4_180-94_130-default-debuginfo >= 2-2.1 kgraft-patch-SLE12-SP3_Update_35 >= 2-2.1

---

Status of this issue by product and package

Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification.

Product(s)	Source package	State
HPE Helion OpenStack 8	kernel-source	Analysis
SUSE Enterprise Storage 5	kernel-source	Analysis
SUSE Linux Enterprise 15-SP1 Module for Basesystem	kernel-source	Released
SUSE Linux Enterprise 15-SP1 Module for Development Tools	kernel-source	Released
SUSE Linux Enterprise 15-SP2 Module for Basesystem	kernel-source	Affected
SUSE Linux Enterprise 15-SP2 Module for Development Tools	kernel-source	Analysis
SUSE Linux Enterprise High Availability Extension 12 SP5	kernel-default	Released
SUSE Linux Enterprise High Performance Computing 12 SP4	kernel-source	Released
SUSE Linux Enterprise High Performance Computing 12 SP5	kernel-default	Released
SUSE Linux Enterprise High Performance Computing 12 SP5	kernel-source	Released
SUSE Linux Enterprise High Performance Computing 12 SP5	kernel-syms	Released
SUSE Linux Enterprise High Performance Computing 15 LTSS	kernel-source	Affected
SUSE Linux Enterprise Live Patching	kernel-default	Released
SUSE Linux Enterprise Live Patching	kgraft-patch-SLE12-SP5_Update_0	Released
SUSE Linux Enterprise Live Patching	kgraft-patch-SLE12-SP5_Update_4	Released
SUSE Linux Enterprise Point of Service 11 SP3	kernel-source	Analysis
SUSE Linux Enterprise Point of Service Image Server 12	kernel-source	Analysis
SUSE Linux Enterprise Server 11 SP1	kernel-source	Not affected
SUSE Linux Enterprise Server 11 SP3	kernel-source	Affected
SUSE Linux Enterprise Server 11 SP4 LTSS	kernel-source	Affected
SUSE Linux Enterprise Server 12 SP1 LTSS	kernel-source	Affected
SUSE Linux Enterprise Server 12 SP2 BCL	kernel-source	Affected
SUSE Linux Enterprise Server 12 SP2 ESPOS	kernel-source	Analysis
SUSE Linux Enterprise Server 12 SP2 LTSS	kernel-source	Affected
SUSE Linux Enterprise Server 12 SP3 BCL	kernel-source	Affected
SUSE Linux Enterprise Server 12 SP3 ESPOS	kernel-source	Analysis
SUSE Linux Enterprise Server 12 SP3 LTSS	kernel-source	Affected
SUSE Linux Enterprise Server 12 SP4	kernel-source	Released
SUSE Linux Enterprise Server 12 SP4 ESPOS	kernel-source	Analysis
SUSE Linux Enterprise Server 12 SP4 LTSS	kernel-source	Analysis
SUSE Linux Enterprise Server 12 SP5	kernel-default	Released
SUSE Linux Enterprise Server 12 SP5	kernel-source	Released
SUSE Linux Enterprise Server 12 SP5	kernel-syms	Released
SUSE Linux Enterprise Server 15 LTSS	kernel-source	Affected
SUSE Linux Enterprise Server ESPOS 15	kernel-source	Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP2	kernel-source	Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP3	kernel-source	Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP4	kernel-source	Released
SUSE Linux Enterprise Server for SAP Applications 12 SP5	kernel-default	Released
SUSE Linux Enterprise Server for SAP Applications 12 SP5	kernel-source	Released
SUSE Linux Enterprise Server for SAP Applications 12 SP5	kernel-syms	Released
SUSE Linux Enterprise Server for SAP Applications 15	kernel-source	Analysis
SUSE OpenStack Cloud 7	kernel-source	Analysis
SUSE OpenStack Cloud 8	kernel-source	Analysis
SUSE OpenStack Cloud 9	kernel-source	Analysis
SUSE OpenStack Cloud Crowbar 8	kernel-source	Analysis
SUSE OpenStack Cloud Crowbar 9	kernel-source	Analysis
SUSE Real Time Module	kernel-rt	Released
SUSE Real Time Module	kernel-rt_debug	Released
SUSE Real Time Module	kernel-source-rt	Released
SUSE Real Time Module	kernel-syms-rt	Released