CVE-2020-9391
kernel: brk discards top byte of addresses on aarch64 causing heap corruption in glibc malloc
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 25, 2020
Updated · June 28, 2026
Description
A heap corruption flaw was found in the Linux kernel on the AArch64 architecture. The top byte is ignored in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards. This has been observed to cause heap corruption within the GNU C Library malloc implementation. The highest threat from this vulnerability is to system availability.
Statement
The affected code was not introduced into any kernel versions shipped with Red Hat Enterprise Linux making this vulnerable not applicable to these platforms.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer