CVE-2020-11494

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.16 through 5.6.2

Description An issue in the Linux kernel allows attackers to read uninitialized can frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG INIT STACK ALL. This issue is related to the slc bump function in drivers/net/can/slcan.c. The exploitation of this issue may allow an attacker to gain unauthorized access to protected information.

Recommendations For Linux kernel versions 3.16 through 5.6.2, consider updating to a version that includes the necessary configuration changes to mitigate this issue, such as enabling CONFIG INIT STACK ALL. As a temporary workaround, consider restricting access to the slc bump function in drivers/net/can/slcan.c to minimize the risk of exploitation.