{
  "cveId": "CVE-2020-12771",
  "url": "https://patchblox.com/security/cve/CVE-2020-12771",
  "summary": "CVE-2020-12771 is fixed in 9 products on 1 platform, first by ELSA-2020-5848, released September 14, 2020. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "kernel-uek: [5.4.17-2011.6.2]\n- Revert \u0027aarch64/BM: config failed, hub doesnt have any ports\u0027 (Thomas Tai)  [Orabug: 31838351] [O...",
  "description": "[5.4.17-2011.6.2]\n- Revert \u0027aarch64/BM: config failed, hub doesnt have any ports\u0027 (Thomas Tai)  [Orabug: 31838351] [Orabug: 31844671] \n- kvm: ioapic: Restrict lazy EOI update to edge-triggered interrupts (Paolo Bonzini)  [Orabug: 31839185] [Orabug: 31844556]\n\n[5.4.17-2011.6.1]\n- nfsd: apply umask on fs without ACL support (J. Bruce Fields)  [Orabug: 31779884]  {CVE-2020-24394}\n- arm64/elf: Disable automatic READ_IMPLIES_EXEC for 64-bit address spaces (Kees Cook)  [Orabug: 31776626] \n- arm32/64/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK (Kees Cook)  [Orabug: 31776626] \n- arm32/64/elf: Add tables to document READ_IMPLIES_EXEC (Kees Cook)  [Orabug: 31776626] \n- x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit (Kees Cook)  [Orabug: 31776626] \n- x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK (Kees Cook)  [Orabug: 31776626] \n- x86/elf: Add table to document READ_IMPLIES_EXEC (Kees Cook)  [Orabug: 31776626] \n- x86/mm: use max memory block size on bare metal (Daniel Jordan)  [Orabug: 31771277] \n- drivers/base/memory.c: cache memory blocks in xarray to accelerate lookup (Scott Cheloha)  [Orabug: 31771277] \n- net/rds: Incorrect pointer used in rds_getname() (Ka-Cheong Poon)  [Orabug: 31755752] \n- RDMA/mlx5: Fix Shared PD prefetch of ODP memory region (Mark Haywood)  [Orabug: 31688620] \n- arm64/dts: Serial console fix for RPi4 (Vijay Kumar)  [Orabug: 31562971] \n- md: get sysfs entry after redundancy attr group create (Junxiao Bi)  [Orabug: 31682033] \n- md: fix deadlock causing by sysfs_notify (Junxiao Bi)  [Orabug: 31682033]\n\n[5.4.17-2011.6.0]\n- RDMA/mlx5: Set MR cache limit for both PF and VF (Nikhil Krishna)  [Orabug: 31358080] \n- rds: ib: Revert \u0027net/rds: Avoid stalled connection due to CM REQ retries\u0027 (Hakon Bugge)  [Orabug: 31648138] \n- rds: Clear reconnect pending bit (Hakon Bugge)  [Orabug: 31648138] \n- RDMA/cm: Spurious WARNING triggered in cm_destroy_id() (Ka-Cheong Poon)  [Orabug: 31483278] \n- RDMA/cm: Make sure the cm_id is in the IB_CM_IDLE state in destroy (Jason Gunthorpe)  [Orabug: 31483278] \n- RDMA/cm: Allow ib_send_cm_sidr_rep() to be done under lock (Jason Gunthorpe)  [Orabug: 31483278] \n- RDMA/cm: Allow ib_send_cm_rej() to be done under lock (Jason Gunthorpe)  [Orabug: 31483278] \n- RDMA/cm: Allow ib_send_cm_drep() to be done under lock (Jason Gunthorpe)  [Orabug: 31483278] \n- RDMA/cm: Allow ib_send_cm_dreq() to be done under lock (Jason Gunthorpe)  [Orabug: 31483278] \n- RDMA/cm: Add some lockdep assertions for cm_id_priv-\u003Elock (Jason Gunthorpe)  [Orabug: 31483278] \n- RDMA/cm: Add missing locking around id.state in cm_dup_req_handler (Jason Gunthorpe)  [Orabug: 31483278] \n- RDMA/cm: Make the destroy_id flow more robust (Jason Gunthorpe)  [Orabug: 31483278] \n- RDMA/cm: Remove a race freeing timewait_info (Jason Gunthorpe)  [Orabug: 31483278] \n- RDMA/cm: Use refcount_t type for refcount variable (Danit Goldberg)  [Orabug: 31483278] \n- bnxt_en: allow firmware to disable VLAN offloads (Michael Chan)  \n- bnxt_en: clean up VLAN feature bit handling (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features(). (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Implement ethtool -X to set indirection table. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Return correct RSS indirection table entries to ethtool -x. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Fill HW RSS table from the RSS logical indirection table. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Add helper function to return the number of RSS contexts. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Add logical RSS indirection table structure. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Fix up bnxt_get_rxfh_indir_size(). (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Set up the chip specific RSS table size. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: fix firmware message length endianness (Michael Chan)  [Orabug: 31663185] \n- net: bnxt: Remove Comparison to bool in bnxt_ethtool.c (Jason Yan)  [Orabug: 31663185] \n- bnxt_en: show only relevant ethtool stats for a TX or RX ring (Rajesh Ravi)  [Orabug: 31663185] \n- bnxt_en: Split HW ring statistics strings into RX and TX parts. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Refactor the software ring counters. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Do not include ETH_FCS_LEN in the max packet length sent to fw. (Vasundhara Volam)  [Orabug: 31663185] \n- bnxt_en: Improve TQM ring context memory sizing formulas. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Allocate TQM ring context memory according to fw specification. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Update firmware spec. to 1.10.1.33. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Return error when allocating zero size context memory. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Reset rings if ring reservation fails during open() (Vasundhara Volam)  [Orabug: 31663185] \n- bnxt_en: Return error if bnxt_alloc_ctx_mem() fails. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Fix Priority Bytes and Packets counters in ethtool -S. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Process the NQ under NAPI continuous polling. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Simplify __bnxt_poll_cqs_done(). (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Handle all NQ notifications in bnxt_poll_p5(). (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Disable workaround for lost interrupts on 575XX B0 and newer chips. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Periodically check and remove aged-out ntuple filters (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Do not accept fragments for aRFS flow steering. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Remove the setting of dev_port. (Michael Chan)  [Orabug: 31663185] \n- bnxt_en: Improve link up detection. (Michael Chan)  [Orabug: 31663185] \n- RDMA/nldev: Provide MR statistics (Erez Alfasi)  [Orabug: 31079901] \n- RDMA/mlx5: Return ODP type per MR (Erez Alfasi)  [Orabug: 31079901] \n- RDMA/nldev: Allow different fill function per resource (Erez Alfasi)  [Orabug: 31079901] \n- IB/mlx5: Introduce ODP diagnostic counters (Erez Alfasi)  [Orabug: 31079901] \n- x86/reboot: Move up iommu_shutdown() before stop_other_cpus() (Saeed Mirzamohammadi)  [Orabug: 31542630] \n- bcache: fix potential deadlock problem in btree_gc_coalesce (Zhiqiang Liu)  [Orabug: 31350643]  {CVE-2020-12771}\n- selinux: properly handle multiple messages in selinux_netlink_send() (Paul Moore)  [Orabug: 31439365]  {CVE-2020-10751}\n- Revert \u0027zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()\u0027 (Wade Mealing)  [Orabug: 31510722]  {CVE-2020-10781}\n- Enable config option CONFIG_NFSD_V4_2_INTER_SSC (Dai Ngo)  [Orabug: 31535947] \n- NFSD: Fix NFS server build errors (Chuck Lever)  [Orabug: 31535947] \n- nfsd4: fix double free in nfsd4_do_async_copy() (Dan Carpenter)  [Orabug: 31535947] \n- NFSD fixing possible null pointer derefering in copy offload (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSD fix nfserro errno mismatch (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSD: fix seqid in copy stateid (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSv4.2 fix memory leak in nfs42_ssc_open (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSv4: Make _nfs42_proc_copy_notify() static (YueHaibing)  [Orabug: 31535947] \n- nfsv4: Move NFSPROC4_CLNT_COPY_NOTIFY to end of list (Trond Myklebust)  [Orabug: 31535947] \n- NFSD: allow inter server COPY to have a STALE source server fh (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSD add nfs4 inter ssc to nfsd4_copy (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSD check stateids against copy stateids (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSD fix mismatching type in nfsd4_set_netaddr (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSD fill-in netloc4 structure (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSD add COPY_NOTIFY operation (Olga Kornievskaia)  [Orabug: 31535947] \nto COPY (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSD COPY_NOTIFY xdr (Olga Kornievskaia)  [Orabug: 31535947] \n- NFSv4.2 fix kfree in __nfs42_copy_file_range (Olga Kornievskaia)  [Orabug: 31535947] \n- NFS based on file size issue sync copy or fallback to generic copy offload (Olga Kornievskaia)  [Orabug: 31535947] \n- NFS: handle source server reboot (Olga Kornievskaia)  [Orabug: 31535947] \n- NFS: skip recovery of copy open on dest server (Olga Kornievskaia)  [Orabug: 31535947] \n- NFS: inter ssc open (Olga Kornievskaia)  [Orabug: 31535947] \nto COPY (Olga Kornievskaia)  [Orabug: 31535947] \n- NFS: add COPY_NOTIFY operation (Olga Kornievskaia)  [Orabug: 31535947] \n- NFS NFSD: defining nl4_servers structure needed by both (Olga Kornievskaia)  [Orabug: 31535947] \n- kvm: svm: Introduce GA Log tracepoint for AVIC (Suravee Suthikulpanit)  [Orabug: 31631367] \n- KVM: SVM: Inhibit APIC virtualization for X2APIC guest (Oliver Upton)  [Orabug: 31631367] \n- KVM: SVM: allocate AVIC data structures based on kvm_amd module parameter (Paolo Bonzini)  [Orabug: 31631367] \n- kvm: x86: svm: Fix NULL pointer dereference when AVIC not enabled (Suravee Suthikulpanit)  [Orabug: 31631367] \n- KVM: SVM: allow AVIC without split irqchip (Paolo Bonzini)  [Orabug: 31631367] \n- kvm: ioapic: Lazy update IOAPIC EOI (Suravee Suthikulpanit)  [Orabug: 31631367] \n- kvm: ioapic: Refactor kvm_ioapic_update_eoi() (Suravee Suthikulpanit)  [Orabug: 31631367] \n- kvm: i8254: Deactivate APICv when using in-kernel PIT re-injection mode. (Suravee Suthikulpanit)  [Orabug: 31631367] \n- svm: Temporarily deactivate AVIC during ExtINT handling (Suravee Suthikulpanit)  [Orabug: 31631367] \n- svm: Deactivate AVIC when launching guest with nested SVM support (Suravee Suthikulpanit)  [Orabug: 31631367] \n- kvm: x86: hyperv: Use APICv update request interface (Suravee Suthikulpanit)  [Orabug: 31631367] \n- svm: Add support for dynamic APICv (Suravee Suthikulpanit)  [Orabug: 31631367] \n- kvm: x86: Introduce x86 ops hook for pre-update APICv (Suravee Suthikulpanit)  [Orabug: 31631367] \n- kvm: x86: Introduce APICv x86 ops for checking APIC inhibit reasons (Suravee Suthikulpanit)  [Orabug: 31631367] \n- KVM: svm: avic: Add support for dynamic setup/teardown of virtual APIC backing page (Suravee Suthikulpanit)  [Orabug: 31631367] \n- kvm: x86: svm: Add support to (de)activate posted interrupts (Suravee Suthikulpanit)  [Orabug: 31631367] \n- kvm: x86: Add APICv (de)activate request trace points (Suravee Suthikulpanit)  [Orabug: 31631367] \n- kvm: x86: Add support for dynamic APICv activation (Suravee Suthikulpanit)  [Orabug: 31631367] \n- KVM: x86: remove get_enable_apicv from kvm_x86_ops (Paolo Bonzini)  [Orabug: 31631367] \n- kvm: x86: Introduce APICv inhibit reason bits (Suravee Suthikulpanit)  [Orabug: 31631367] \n- kvm: lapic: Introduce APICv update helper function (Suravee Suthikulpanit)  [Orabug: 31631367] \n- KVM: X86: Drop KVM_APIC_SHORT_MASK and KVM_APIC_DEST_MASK (Peter Xu)  [Orabug: 31631367] \n- KVM: SVM: Remove check if APICv enabled in SVM update_cr8_intercept() handler (Liran Alon)  [Orabug: 31631367] \n- kvm: x86: Modify kvm_x86_ops.get_enable_apicv() to use struct kvm parameter (Suthikulpanit, Suravee)  [Orabug: 31631367] \n- kvm: Increase KVM_USER_MEM_SLOTS for dense memory hotplug (Eric DeVolder)  [Orabug: 31694365] \n- random32: update the net random state on interrupt and activity (Willy Tarreau)  [Orabug: 31698078]  {CVE-2020-16166}\n- vgacon: Fix for missing check in scrollback handling (Yunhai Zhang)  [Orabug: 31705117]  {CVE-2020-14331} {CVE-2020-14331}\n- net/rds: Incorrect WARN_ON() (Ka-Cheong Poon)  [Orabug: 31718014]",
  "published": "2020-09-14T00:00:00Z",
  "severity": "IMPORTANT",
  "cvss": 5.5,
  "epss": 0.00519,
  "epssPercentile": 0.44269,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "kernel-uek",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2011.6.2.el8uek",
      "fix": "ELSA-2020-5848",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-5848",
      "released": "2020-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2011.6.2.el8uek",
      "fix": "ELSA-2020-5848",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-5848",
      "released": "2020-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2011.6.2.el8uek",
      "fix": "ELSA-2020-5848",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-5848",
      "released": "2020-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2011.6.2.el8uek",
      "fix": "ELSA-2020-5848",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-5848",
      "released": "2020-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-doc",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2011.6.2.el8uek",
      "fix": "ELSA-2020-5848",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-5848",
      "released": "2020-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-tools",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2011.6.2.el7uek",
      "fix": "ELSA-2020-5848",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-5848",
      "released": "2020-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-tools-libs",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2011.6.2.el7uek",
      "fix": "ELSA-2020-5848",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-5848",
      "released": "2020-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "perf",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2011.6.2.el7uek",
      "fix": "ELSA-2020-5848",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-5848",
      "released": "2020-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python-perf",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2011.6.2.el7uek",
      "fix": "ELSA-2020-5848",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-5848",
      "released": "2020-09-14T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T06:34:28Z"
}