{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2020-36787", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-26T17:07:27.435Z", "datePublished": "2024-02-28T08:13:07.275Z", "dateUpdated": "2026-08-05T08:44:30.930Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:44:30.930Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: aspeed: fix clock handling logic\n\nVideo engine uses eclk and vclk for its clock sources and its reset\ncontrol is coupled with eclk so the current clock enabling sequence works\nlike below.\n\n Enable eclk\n De-assert Video Engine reset\n 10ms delay\n Enable vclk\n\nIt introduces improper reset on the Video Engine hardware and eventually\nthe hardware generates unexpected DMA memory transfers that can corrupt\nmemory region in random and sporadic patterns. This issue is observed\nvery rarely on some specific AST2500 SoCs but it causes a critical\nkernel panic with making a various shape of signature so it's extremely\nhard to debug. Moreover, the issue is observed even when the video\nengine is not actively used because udevd turns on the video engine\nhardware for a short time to make a query in every boot.\n\nTo fix this issue, this commit changes the clock handling logic to make\nthe reset de-assertion triggered after enabling both eclk and vclk. Also,\nit adds clk_unprepare call for a case when probe fails.\n\nclk: ast2600: fix reset settings for eclk and vclk\nVideo engine reset setting should be coupled with eclk to match it\nwith the setting for previous Aspeed SoCs which is defined in\nclk-aspeed.c since all Aspeed SoCs are sharing a single video engine\ndriver. Also, reset bit 6 is defined as 'Video Engine' reset in\ndatasheet so it should be de-asserted when eclk is enabled. This\ncommit fixes the setting." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached by opening the Aspeed V4L2 video device (/dev/videoX), which calls aspeed_video_open → aspeed_video_start → aspeed_video_on and enables the video-engine clocks; this is a local device-file/syscall path, not a network-facing kernel protocol.\nAC:L - An attacker who can open the device reliably executes the faulty eclk-before-vclk enable sequence (and can repeat open/close to retry); no attacker-uncontrollable race or victim state is required to hit the vulnerable path.\nPR:L - Access is gated only by ordinary /dev/video* permissions (typically root:video 0660); the driver performs no capability checks, so a low-privileged local user with video-group access can trigger it without real root.\nUI:N - The attacker triggers the vulnerability directly by opening the video device; no separate victim action is required (udev QUERYCAP at boot also hits the same path without user interaction).\nS:U - Unexpected DMA corrupts memory in the same kernel/BMC security authority that hosts the driver; there is no demonstrated cross-boundary impact such as guest-to-host escape or IOMMU bypass.\nC:H - The faulty reset/clock sequence causes unexpected DMA transfers that can touch arbitrary memory regions; such hardware memory corruption can be leveraged for information disclosure, so confidentiality impact is High.\nI:H - The commit documents DMA writes that corrupt memory in random patterns; uncontrolled kernel memory corruption is treated as High integrity impact because it can enable control-flow hijacking or arbitrary modification.\nA:H - The same rogue DMA leads to critical kernel panics/oopses with varying crash signatures, which is High availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/clk-ast2600.c", "drivers/media/platform/aspeed-video.c" ], "versions": [ { "version": "d2b4387f3bdf016e266d23cf657465f557721488", "lessThan": "1dc1d30ac101bb8335d9852de2107af60c2580e7", "status": "affected", "versionType": "git" }, { "version": "d2b4387f3bdf016e266d23cf657465f557721488", "lessThan": "a59d01384c80a8a4392665802df57c3df20055f5", "status": "affected", "versionType": "git" }, { "version": "d2b4387f3bdf016e266d23cf657465f557721488", "lessThan": "2964c37563e86cfdc439f217eb3c5a69adfdba6a", "status": "affected", "versionType": "git" }, { "version": "d2b4387f3bdf016e266d23cf657465f557721488", "lessThan": "75321dc8aebe3f30eff226028fe6da340fe0bf02", "status": "affected", "versionType": "git" }, { "version": "d2b4387f3bdf016e266d23cf657465f557721488", "lessThan": "3536169f8531c2c5b153921dc7d1ac9fd570cda7", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/clk-ast2600.c", "drivers/media/platform/aspeed-video.c" ], "versions": [ { "version": "5.0", "status": "affected" }, { "version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.119", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.37", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.11.21", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.12.4", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.4.119" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.10.37" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.11.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.12.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1dc1d30ac101bb8335d9852de2107af60c2580e7" }, { "url": "https://git.kernel.org/stable/c/a59d01384c80a8a4392665802df57c3df20055f5" }, { "url": "https://git.kernel.org/stable/c/2964c37563e86cfdc439f217eb3c5a69adfdba6a" }, { "url": "https://git.kernel.org/stable/c/75321dc8aebe3f30eff226028fe6da340fe0bf02" }, { "url": "https://git.kernel.org/stable/c/3536169f8531c2c5b153921dc7d1ac9fd570cda7" } ], "title": "media: aspeed: fix clock handling logic", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2020-36787", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-02-28T21:09:13.755669Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:12:23.237Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:37:07.341Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/1dc1d30ac101bb8335d9852de2107af60c2580e7", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a59d01384c80a8a4392665802df57c3df20055f5", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/2964c37563e86cfdc439f217eb3c5a69adfdba6a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/75321dc8aebe3f30eff226028fe6da340fe0bf02", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/3536169f8531c2c5b153921dc7d1ac9fd570cda7", "tags": [ "x_transferred" ] } ] } ] } }