CVE-2020-10711 json
A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7.
published 2020-05-22 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-3141
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.
Patch / fix
- linux linux_kernel 5.7
- linux Debian 14, Debian 13, Debian 12 5.6.14-1
debian advisories DEBIAN-CVE-2020-10711
- linux Ubuntu 16.04 LTS 4.4.0-185.215
- linux Ubuntu 18.04 LTS 4.15.0-109.110
- linux Ubuntu 20.04 LTS 5.4.0-40.44
- linux-aws Ubuntu 16.04 LTS 4.4.0-1110.121
- linux-aws Ubuntu 18.04 LTS 4.15.0-1077.81
- linux-aws Ubuntu 20.04 LTS 5.4.0-1018.18
- linux-gcp Ubuntu 16.04 LTS 4.15.0-1078.88~16.04.1
- linux-gcp Ubuntu 20.04 LTS 5.4.0-1019.19
ubuntu advisories UBUNTU-CVE-2020-10711
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-alt RHEL 7 4.14.0-115.21.2.el7a
- perf RHEL 7 4.14.0-115.21.2.el7a
- kernel RHEL 7 4.14.0-115.21.2.el7a
- python-perf RHEL 7 4.14.0-115.21.2.el7a
- kernel-tools RHEL 7 4.14.0-115.21.2.el7a
- kernel-tools-libs RHEL 7 4.14.0-115.21.2.el7a
- kernel-bootwrapper RHEL 7 4.14.0-115.21.2.el7a
- kernel-abi-whitelists RHEL 7 4.14.0-115.21.2.el7a
red hat advisories RHSA-2020:2104RHSA-2020:2429RHSA-2020:2199RHSA-2020:2102RHSA-2020:2519RHSA-2020:2522
- kernel-rt Real Time Module 15 SP1 4.12.14-14.28.1
- kernel-syms-rt Real Time Module 15 SP1 4.12.14-14.28.1
- kernel-rt_debug Real Time Module 15 SP1 4.12.14-14.28.1
- kernel-source-rt Real Time Module 15 SP1 4.12.14-14.28.1
- kernel-rt SLE Real Time 12 SP5 4.12.14-10.13.1
- kernel-syms-rt SLE Real Time 12 SP5 4.12.14-10.13.1
- kernel-rt_debug SLE Real Time 12 SP5 4.12.14-10.13.1
- kernel-source-rt SLE Real Time 12 SP5 4.12.14-10.13.1
suse advisories SUSE-SU-2020:2487-1SUSE-SU-2020:2478-1SUSE-SU-2020:2156-1SUSE-SU-2020:2152-1SUSE-SU-2020:2134-1SUSE-SU-2020:2105-1
- kernel-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
- kernel-syms-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
- kernel-rt_debug openSUSE Leap 15.2 5.3.18-lp152.3.5.1
- kernel-source-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
- kernel-syms openSUSE Leap 15.2 5.3.18-lp152.26.2
- kernel-obs-qa openSUSE Leap 15.2 5.3.18-lp152.26.2
- kernel-source openSUSE Leap 15.2 5.3.18-lp152.26.2
- kernel-default openSUSE Leap 15.2 5.3.18-lp152.26.2
opensuse advisories openSUSE-SU-2021:0242-1openSUSE-SU-2020:0935-1openSUSE-SU-2020:0801-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-10711 updated cvss 5.9
Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause kernel panic
-
Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-193.1.2.el8_2, kernel-debuginfo-common-aarch64 4.18.0-193.1.2.el8_2, kernel-debuginfo-common-ppc64le 4.18.0-193.1.2.el8_2fixed: vendor fix RHSA-2020:2102
-
Red Hat CodeReady Linux Builder EUS (v. 8.1) kernel-debuginfo-common-x86_64 4.18.0-147.13.2.el8_1, kernel-debuginfo-common-aarch64 4.18.0-147.13.2.el8_1, kernel-debuginfo-common-ppc64le 4.18.0-147.13.2.el8_1fixed: vendor fix RHSA-2020:2199
-
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-193.1.2.el8_2, kernel 4.18.0-193.1.2.el8_2, bpftool 4.18.0-193.1.2.el8_2, kpatch-patch-4_18_0-193 1-2.el8, kernel-core 4.18.0-193.1.2.el8_2, kernel-tools 4.18.0-193.1.2.el8_2, +16 morefixed: vendor fix RHSA-2020:2102
-
Red Hat Enterprise Linux BaseOS E4S (v. 8.0) perf 4.18.0-80.23.2.el8_0, kernel 4.18.0-80.23.2.el8_0, bpftool 4.18.0-80.23.2.el8_0, kernel-core 4.18.0-80.23.2.el8_0, kernel-tools 4.18.0-80.23.2.el8_0, python3-perf 4.18.0-80.23.2.el8_0, +9 morefixed: vendor fix RHSA-2020:2429
-
Red Hat Enterprise Linux BaseOS EUS (v. 8.1) perf 4.18.0-147.13.2.el8_1, kernel 4.18.0-147.13.2.el8_1, bpftool 4.18.0-147.13.2.el8_1, kpatch-patch-4_18_0-147 1-13.el8, kernel-core 4.18.0-147.13.2.el8_1, kernel-tools 4.18.0-147.13.2.el8_1, +21 morefixed: vendor fix RHSA-2020:2199
-
Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-1127.8.2.el7, kernel 3.10.0-1127.8.2.el7, bpftool 3.10.0-1127.8.2.el7, python-perf 3.10.0-1127.8.2.el7, kernel-tools 3.10.0-1127.8.2.el7, kernel-tools-libs 3.10.0-1127.8.2.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1127.8.2.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-1127.8.2.el7, kernel 3.10.0-1127.8.2.el7, bpftool 3.10.0-1127.8.2.el7, python-perf 3.10.0-1127.8.2.el7, kernel-tools 3.10.0-1127.8.2.el7, kernel-tools-libs 3.10.0-1127.8.2.el7, +2 morefixed: vendor fix RHSA-2020:2082
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) perf 3.10.0-957.54.1.el7, kernel 3.10.0-957.54.1.el7, bpftool 3.10.0-957.54.1.el7, python-perf 3.10.0-957.54.1.el7, kernel-tools 3.10.0-957.54.1.el7, kernel-tools-libs 3.10.0-957.54.1.el7, +2 morefixed: vendor fix RHSA-2020:2289
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) perf 3.10.0-1062.26.1.el7, kernel 3.10.0-1062.26.1.el7, bpftool 3.10.0-1062.26.1.el7, python-perf 3.10.0-1062.26.1.el7, kernel-tools 3.10.0-1062.26.1.el7, kernel-tools-libs 3.10.0-1062.26.1.el7, +2 morefixed: vendor fix RHSA-2020:2522
show 26 moreshow fewer
-
Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1127.8.2.el7fixed: vendor fix RHSA-2020:2082
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) kernel-debuginfo-common-x86_64 3.10.0-957.54.1.el7fixed: vendor fix RHSA-2020:2289
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) kernel-debuginfo-common-x86_64 3.10.0-1062.26.1.el7fixed: vendor fix RHSA-2020:2522
-
Red Hat Enterprise Linux Desktop (v. 6) perf 2.6.32-754.29.2.el6, kernel 2.6.32-754.29.2.el6, kernel-firmware 2.6.32-754.29.2.el6, kernel-abi-whitelists 2.6.32-754.29.2.el6, kernel-debuginfo-common-i686 2.6.32-754.29.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.29.2.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) python-perf 2.6.32-754.29.2.el6, kernel-debuginfo-common-i686 2.6.32-754.29.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.29.2.el6fixed: vendor fix RHSA-2020:2103
-
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) perf 4.14.0-115.21.2.el7a, kernel 4.14.0-115.21.2.el7a, kernel-alt 4.14.0-115.21.2.el7a, python-perf 4.14.0-115.21.2.el7a, kernel-tools 4.14.0-115.21.2.el7a, kernel-tools-libs 4.14.0-115.21.2.el7a, +3 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) kernel-debuginfo-common-ppc64le 4.14.0-115.21.2.el7afixed: vendor fix RHSA-2020:2104
-
Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-1127.8.2.rt56.1103.el7, kernel-rt-kvm 3.10.0-1127.8.2.rt56.1103.el7, kernel-rt-trace 3.10.0-1127.8.2.rt56.1103.el7, kernel-rt-debug-kvm 3.10.0-1127.8.2.rt56.1103.el7, kernel-rt-trace-kvm 3.10.0-1127.8.2.rt56.1103.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1127.8.2.rt56.1103.el7fixed: vendor fix RHSA-2020:2085
-
Red Hat Enterprise Linux HPC Node (v. 6) perf 2.6.32-754.29.2.el6, kernel 2.6.32-754.29.2.el6, kernel-firmware 2.6.32-754.29.2.el6, kernel-abi-whitelists 2.6.32-754.29.2.el6, kernel-debuginfo-common-i686 2.6.32-754.29.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.29.2.el6 Red Hat Enterprise Linux HPC Node Optional (v. 6) python-perf 2.6.32-754.29.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.29.2.el6fixed: vendor fix RHSA-2020:2103
-
Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-core 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-modules 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-debug-core 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-debug-modules 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-modules-extra 4.18.0-193.1.2.rt13.53.el8_2, +2 more Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-kvm 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-core 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-modules 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-debug-kvm 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-debug-core 4.18.0-193.1.2.rt13.53.el8_2, +4 morefixed: vendor fix RHSA-2020:2171
-
Red Hat Enterprise Linux Realtime (v. 7) kernel-rt 3.10.0-1127.8.2.rt56.1103.el7, kernel-rt-trace 3.10.0-1127.8.2.rt56.1103.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1127.8.2.rt56.1103.el7fixed: vendor fix RHSA-2020:2085
-
Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-754.29.2.el6, kernel 2.6.32-754.29.2.el6, kernel-kdump 2.6.32-754.29.2.el6, kernel-firmware 2.6.32-754.29.2.el6, kernel-bootwrapper 2.6.32-754.29.2.el6, kernel-abi-whitelists 2.6.32-754.29.2.el6, +4 morefixed: vendor fix RHSA-2020:2103
-
Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-1127.8.2.el7, kernel 3.10.0-1127.8.2.el7, bpftool 3.10.0-1127.8.2.el7, python-perf 3.10.0-1127.8.2.el7, kernel-kdump 3.10.0-1127.8.2.el7, kernel-tools 3.10.0-1127.8.2.el7, +7 morefixed: vendor fix RHSA-2020:2082
-
Red Hat Enterprise Linux Server AUS (v. 7.2) perf 3.10.0-327.88.1.el7, kernel 3.10.0-327.88.1.el7, python-perf 3.10.0-327.88.1.el7, kernel-tools 3.10.0-327.88.1.el7, kernel-tools-libs 3.10.0-327.88.1.el7, kernel-abi-whitelists 3.10.0-327.88.1.el7, +1 morefixed: vendor fix RHSA-2020:2285
-
Red Hat Enterprise Linux Server AUS (v. 7.3) perf 3.10.0-514.76.1.el7, kernel 3.10.0-514.76.1.el7, python-perf 3.10.0-514.76.1.el7, kernel-tools 3.10.0-514.76.1.el7, kernel-tools-libs 3.10.0-514.76.1.el7, kernel-abi-whitelists 3.10.0-514.76.1.el7, +1 morefixed: vendor fix RHSA-2020:2277
-
Red Hat Enterprise Linux Server AUS (v. 7.4) perf 3.10.0-693.67.1.el7, kernel 3.10.0-693.67.1.el7, python-perf 3.10.0-693.67.1.el7, kernel-tools 3.10.0-693.67.1.el7, kernel-tools-libs 3.10.0-693.67.1.el7, kernel-abi-whitelists 3.10.0-693.67.1.el7, +1 morefixed: vendor fix RHSA-2020:2214
-
Red Hat Enterprise Linux Server E4S (v. 7.3) perf 3.10.0-514.76.1.el7, kernel 3.10.0-514.76.1.el7, python-perf 3.10.0-514.76.1.el7, kernel-tools 3.10.0-514.76.1.el7, kernel-tools-libs 3.10.0-514.76.1.el7, kernel-bootwrapper 3.10.0-514.76.1.el7, +3 morefixed: vendor fix RHSA-2020:2277
-
Red Hat Enterprise Linux Server E4S (v. 7.4) perf 3.10.0-693.67.1.el7, kernel 3.10.0-693.67.1.el7, python-perf 3.10.0-693.67.1.el7, kernel-tools 3.10.0-693.67.1.el7, kernel-tools-libs 3.10.0-693.67.1.el7, kernel-bootwrapper 3.10.0-693.67.1.el7, +3 morefixed: vendor fix RHSA-2020:2214
-
Red Hat Enterprise Linux Server EUS (v. 7.6) perf 3.10.0-957.54.1.el7, kernel 3.10.0-957.54.1.el7, bpftool 3.10.0-957.54.1.el7, python-perf 3.10.0-957.54.1.el7, kernel-kdump 3.10.0-957.54.1.el7, kernel-tools 3.10.0-957.54.1.el7, +16 morefixed: vendor fix RHSA-2020:2289
-
Red Hat Enterprise Linux Server EUS (v. 7.7) perf 3.10.0-1062.26.1.el7, kernel 3.10.0-1062.26.1.el7, bpftool 3.10.0-1062.26.1.el7, python-perf 3.10.0-1062.26.1.el7, kernel-kdump 3.10.0-1062.26.1.el7, kernel-tools 3.10.0-1062.26.1.el7, +18 morefixed: vendor fix RHSA-2020:2522
-
Red Hat Enterprise Linux Server Optional (v. 6) python-perf 2.6.32-754.29.2.el6, kernel-debuginfo-common-i686 2.6.32-754.29.2.el6, kernel-debuginfo-common-ppc64 2.6.32-754.29.2.el6, kernel-debuginfo-common-s390x 2.6.32-754.29.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.29.2.el6fixed: vendor fix RHSA-2020:2103
-
Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-1127.8.2.el7, kernel-debuginfo-common-x86_64 3.10.0-1127.8.2.el7, kernel-debuginfo-common-ppc64le 3.10.0-1127.8.2.el7fixed: vendor fix RHSA-2020:2082
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.2) kernel-debuginfo-common-x86_64 3.10.0-327.88.1.el7fixed: vendor fix RHSA-2020:2285
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.3) kernel-debuginfo-common-x86_64 3.10.0-514.76.1.el7fixed: vendor fix RHSA-2020:2277
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.67.1.el7fixed: vendor fix RHSA-2020:2214
-
Red Hat Enterprise Linux Server Optional E4S (v. 7.3) kernel-debuginfo-common-x86_64 3.10.0-514.76.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-514.76.1.el7fixed: vendor fix RHSA-2020:2277
-
Red Hat Enterprise Linux Server Optional E4S (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.67.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-693.67.1.el7fixed: vendor fix RHSA-2020:2214
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.6) kernel-debuginfo-common-ppc64 3.10.0-957.54.1.el7, kernel-debuginfo-common-x86_64 3.10.0-957.54.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-957.54.1.el7fixed: vendor fix RHSA-2020:2289
11 more fixed, 1 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
3.08% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Affected products
- Red Hat Kernel
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
- Technology feeds
References
-
bugzilla.redhat.com
/show_bug.cgi?id=CVE-2020-10711
issue-tracking, patch, third-party-advisory
-
openwall.com
/lists/oss-security/2020/05/12/2
mailing-list, patch, third-party-advisory
-
debian.org
/security/2020/dsa-4698
vendor-advisory, third-party-advisory
-
debian.org
/security/2020/dsa-4699
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-06/msg00022.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-07/msg00008.html
vendor-advisory, mailing-list, third-party-advisory
-
usn.ubuntu.com
/4413-1/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/4411-1/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/4412-1/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/4419-1/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/4414-1/
vendor-advisory, third-party-advisory
-
security.netapp.com
/advisory/ntap-20200608-0001/
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2020/06/msg00012.html
mailing-list, third-party-advisory
Sources
- CVE List CVE-2020-10711
- NVD CVE-2020-10711
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.