CVE-2020-36313
📋 TL;DR
This vulnerability in the Linux kernel's KVM subsystem allows out-of-range access to memory slots after deletion, potentially leading to memory corruption. It affects Linux systems running kernel versions before 5.7 with KVM virtualization enabled. Attackers with access to a guest VM could exploit this to compromise the host system.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Full host system compromise through memory corruption leading to arbitrary code execution on the hypervisor.
Likely Case
Guest-to-host escape resulting in privilege escalation, denial of service, or information disclosure from the host.
If Mitigated
Limited impact if KVM is disabled or proper access controls restrict who can create/manage VMs.
🎯 Exploit Status
Requires access to a guest VM and knowledge of KVM internals. No public exploits have been documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.7 and later
Vendor Advisory: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.7 or later. 2. Reboot the system. 3. For distributions with backported patches, apply the security update for CVE-2020-36313.
🔧 Temporary Workarounds
Disable KVM
linuxDisable KVM virtualization if not required
modprobe -r kvm
echo 'blacklist kvm' >> /etc/modprobe.d/blacklist.conf
🧯 If You Can't Patch
- Restrict VM creation/management to trusted administrators only
- Implement strict network segmentation between VMs and critical systems
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If version is < 5.7 and KVM is loaded (lsmod | grep kvm), system is vulnerable.Check Version:
uname -rVerify Fix Applied:
Verify kernel version is ≥ 5.7 with uname -r and check that the system is stable with KVM enabled.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- KVM module crash reports
- Unexpected memory access errors in dmesg
Network Indicators:
- Unusual VM-to-host communication patterns
SIEM Query:
source="kernel" AND ("KVM" OR "memslot") AND ("panic" OR "crash" OR "corruption")🔗 References
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0774a964ef561b7170d8d1b1bfe6f88002b6d219
- https://security.netapp.com/advisory/ntap-20210604-0005/
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0774a964ef561b7170d8d1b1bfe6f88002b6d219
- https://security.netapp.com/advisory/ntap-20210604-0005/
