CVE-2020-36311

Description

A flaw was found in the Linux kernel. This flaw allows attackers to cause a denial of service (soft lockup) by triggering the destruction of a large SEV VM, which requires unregistering many encrypted regions. The highest threat from this vulnerability is to system availability.

Statement

This issue does not affect the versions of the kernel packages as shipped with the Red Hat Enterprise Linux 6 and 7, as they did not include support for SEV. Red Hat Enterprise Linux 8 currently provides SEV as a Technology Preview. Using SEV in a production environment is discouraged. See https://access.redhat.com/articles/4491591.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score2.85.5N/A
Attack VectorLocalLocalN/A
Attack ComplexityLowLowN/A
Privileges RequiredLowLowN/A
User InteractionRequiredNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityNoneNoneN/A
Integrity ImpactNoneNoneN/A
Availability ImpactLowHighN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat CVSS v3 Score Explanation

Triggering this flaw requires user to create and subsequently destroy a Virtual Machine. This requirement is reflected in UI:R and PR:L. Furthermore, this flaw will not lead to catastrophic loss of availability consequently lowering availability score to Low.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.