ASA-2020-00049 – Linux kernel: Kernel stack information leak on s390/s390x platform

Allele Security Alert



ASA-2020-00049, CVE-2020-10773


Kernel stack information leak on s390/s390x platform


Linux foundation


Linux kernel

Affected version(s)

Linux kernel version 5.3.x before 5.3.9
Linux kernel version 4.19.x before 4.19.82
Linux kernel version 4.14.x before 4.14.152
Linux kernel version 4.9.x before 4.9.199
Linux kernel version 4.4.x before 4.4.199
Linux kernel version 3.16.x before 3.16.80

Fixed version(s)

Linux kernel version 5.4
Linux kernel version 5.3.9
Linux kernel version 4.19.82
Linux kernel version 4.14.152
Linux kernel version 4.9.199
Linux kernel version 4.4.199
Linux kernel version 3.16.80

Linux kernel versions with the following commit applied:

s390/cmm: fix information leak in cmm_timeout_handler()

Proof of concept



In function cmm_timeout_handler() in file arch/s390/mm/cmm.c, there is a logic error which set null byte too far away from user input which means user input won’t be null terminated. And then, kernel stack data will be concatenated with user input and be processed. By querying the result, attacker is able to see the kernel data.

Technical details

The problem is that the NULL terminator was being put too far:

buf[sizeof(buf) - 1] = '\0';

If the user input isn’t NULL terminated and they haven’t initialized the whole buffer then it leads to an info leak. The NULL terminator should be:

buf[len - 1] = '\0';




Bug 1846380 (CVE-2020-10773) – CVE-2020-10773 kernel: kernel stack information leak on s390/s390x

s390/cmm: fix information leak in cmm_timeout_handler()

s390/cmm: fix information leak in cmm_timeout_handler()

Linux 5.4

Linux 5.3.9

Linux 4.19.82

Linux 4.14.152

Linux 4.9.199

Linux 4.4.199

Linux 3.16.80

CVE-2020-10773 - Red Hat Customer Portal

CVE-2020-10773 in Ubuntu

CVE-2020-10773 | SUSE




If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: September 16, 2020

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.