CVE-2020-36791

Q: What is the severity of CVE-2020-36791?

CVE-2020-36791 has a CVSS score of 7.1 (HIGH). This CVE describes an out-of-bounds memory access vulnerability in the Linux kernel's net_sched subsystem. The flaw occurs when the alloc_hash variable isn't properly updated after hash allocation, potentially allowing attackers to read or write beyond allocated memory boundaries. This affects Linux systems using the affected kernel versions.

7.1 HIGH

Denial of Service

📋 TL;DR

This CVE describes an out-of-bounds memory access vulnerability in the Linux kernel's net_sched subsystem. The flaw occurs when the alloc_hash variable isn't properly updated after hash allocation, potentially allowing attackers to read or write beyond allocated memory boundaries. This affects Linux systems using the affected kernel versions.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches exist for multiple stable branches (see references).

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires tcindex classifier to be configured and used. Not all systems will have this enabled by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, potential privilege escalation to root, or arbitrary code execution in kernel context.

🟠

Likely Case

System instability, crashes, or denial of service affecting network traffic classification functionality.

🟢

If Mitigated

Limited impact if exploit attempts are blocked by kernel hardening features or if the vulnerable code path isn't triggered.

🌐 Internet-Facing: MEDIUM - Requires specific network traffic manipulation and kernel configuration to trigger remotely.

🏢 Internal Only: MEDIUM - Local users could potentially exploit this to escalate privileges or cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to manipulate network traffic classification rules and trigger the specific code path. No public exploit code identified in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes (see git.kernel.org references)

Vendor Advisory: https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable tcindex classifier

linux

Remove or disable tcindex traffic classifier if not required

# Check if tcindex is in use
tc filter show
# Remove tcindex rules if present
tc filter del dev <interface> parent <handle>

🧯 If You Can't Patch

Implement strict network traffic filtering to prevent unauthorized manipulation of tc rules
Enable kernel hardening features like KASLR and restrict user access to network configuration tools

🔍 How to Verify

Check if Vulnerable:

Check kernel version against your distribution's security advisories. Vulnerable if using unpatched kernel with tcindex classifier enabled.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version matches patched version from vendor advisory and check that tc filter commands work without crashes.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
OOM killer activity related to network subsystem
System crashes during network configuration changes

Network Indicators:

Unexpected network classification rule changes
Abnormal tc command usage patterns

SIEM Query:

Search for kernel logs containing 'panic', 'Oops', or 'BUG' messages related to net_sched or tcindex

📊 Metadata

CVE ID: CVE-2020-36791

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

EPSS Score: 0.02% exploit probability (5.5th percentile)

Published: May 7, 2025

Last Updated: November 10, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable tcindex classifier

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities