CVE-2020-14385

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-131

Affected software

Vendor	Product	Versions
Linux Kernel	kernel	before 5.9-rc4

References

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.htmlBroken Link
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14385Issue Tracking, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f4020438fab05364018c91f7e02ebdd192085933Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/4576-1/Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.htmlBroken Link
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14385Issue Tracking, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f4020438fab05364018c91f7e02ebdd192085933Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/4576-1/Third Party Advisory

Timeline

Published: Sep 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-143867.8A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes.CVE-2020-143877.4A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, un CVE-2020-143886.3A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforce CVE-2020-143898.1It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account CVE-2020-14398.8A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source CVE-2020-143905.6A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading CVE-2020-143915.5A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer CVE-2020-143925.5An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() CVE-2020-143937.1A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string longer than 300 characters could CVE-2020-143943.2An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) CVE-2020-143967.5An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference.CVE-2020-143977.5An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.