CVE-2020-36766: Linux Kernel Information Disclosure Flaw

CVE-2020-36766 Overview

CVE-2020-36766 is an information disclosure vulnerability in the Linux kernel before version 5.8.6. The flaw resides in drivers/media/cec/core/cec-api.c, which handles the Consumer Electronics Control (CEC) API used by media devices. On specific hardware, the kernel leaks one byte of memory to unprivileged local users due to a structure hole in struct cec_log_addrs being copied to userspace through direct assignment. The issue requires local access and yields a small confidentiality impact on uninitialized kernel data.

Critical Impact
A local unprivileged user can read one byte of uninitialized kernel memory through the CEC ioctl interface, potentially aiding further exploitation through information disclosure.

Affected Products

Linux kernel versions prior to 5.8.6
Systems with CEC-capable media hardware exposing /dev/cecX
Distributions shipping pre-5.8.6 kernels without the backported fix

Discovery Timeline

2023-09-18 - CVE-2020-36766 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-36766

Vulnerability Analysis

The vulnerability stems from a structure padding hole in struct cec_log_addrs. The CEC subsystem implements ioctl handlers that return logical address configuration to userspace. The original code used direct struct assignment to copy the adapter's log_addrs field into a local variable before invoking copy_to_user(). Direct assignment is permitted by the C compiler to skip padding bytes, leaving those bytes containing whatever stack data preceded the local variable. When the local struct is subsequently copied to userspace in full, the padding byte exposes one byte of uninitialized kernel stack memory. The leak is classified under [CWE-noinfo] in NVD and corresponds to a kernel information exposure pattern.

Root Cause

The root cause is the use of struct assignment (log_addrs = adap->log_addrs;) combined with a trailing padding hole inside struct cec_log_addrs. Compilers are not required to initialize or copy padding during assignment, so the destination retains stack-resident bytes that are later sent to userspace via copy_to_user().

Attack Vector

Exploitation requires local access and low privileges. An attacker invokes the affected CEC ioctl on a system with CEC-capable hardware and reads back the structure to recover the leaked byte. The impact is limited to confidentiality of a single byte per call, although repeated invocation could yield additional samples useful for defeating kernel address space layout randomization or extracting fragments of sensitive stack data.

 	struct cec_log_addrs log_addrs;
 
 	mutex_lock(&adap->lock);
-	log_addrs = adap->log_addrs;
+	/*
+	 * We use memcpy here instead of assignment since there is a
+	 * hole at the end of struct cec_log_addrs that an assignment
+	 * might ignore. So when we do copy_to_user() we could leak
+	 * one byte of memory.
+	 */
+	memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs));
 	if (!adap->is_configured)
 		memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID,
 		       sizeof(log_addrs.log_addr));

Source: Linux kernel commit 6c42227 — replaces struct assignment with memcpy() to ensure the padding hole is also copied from the adapter, eliminating the leak.

Detection Methods for CVE-2020-36766

Indicators of Compromise

Unexpected processes opening /dev/cec0 or other CEC device nodes by unprivileged users
Repeated CEC_ADAP_G_LOG_ADDRS ioctl invocations from non-media applications
Local users enumerating /dev/cec* device files outside expected media workflows

Detection Strategies

Audit kernel version against 5.8.6 baseline using uname -r across managed Linux fleets
Monitor openat and ioctl syscalls targeting CEC device nodes via auditd or eBPF tracing
Correlate access to CEC interfaces with the process identity and parent command line

Monitoring Recommendations

Forward Linux audit logs for /dev/cec* access into a centralized SIEM for retention and correlation
Track package manager events that install or update the kernel and verify the 5.8.6 fix is present
Alert on unprivileged processes performing ioctl traffic against media subsystems on servers without CEC use cases

How to Mitigate CVE-2020-36766

Immediate Actions Required

Upgrade to Linux kernel 5.8.6 or later, or apply the distribution backport that includes commit 6c42227c3467
Restrict access to /dev/cec* device nodes through udev rules so only trusted media services can open them
Remove unused CEC kernel modules on systems that do not require CEC functionality

Patch Information

The upstream fix replaces direct struct assignment with memcpy() in drivers/media/cec/core/cec-api.c. The patch is available in the Linux kernel commit 6c42227 and is included in the Linux Kernel Changelog 5.8.6. Distributions such as Debian, Ubuntu, Red Hat, and SUSE have shipped the fix in their respective stable kernel updates.

Workarounds

Blacklist the cec kernel module on systems that do not require HDMI CEC support
Set restrictive permissions on /dev/cec* via udev to limit exposure to the affected ioctl path
Constrain local access on multi-user systems where the kernel cannot be updated immediately

bash

# Block the CEC module and tighten device permissions until patched
echo 'blacklist cec' | sudo tee /etc/modprobe.d/disable-cec.conf
echo 'KERNEL=="cec[0-9]*", MODE="0600", OWNER="root"' | sudo tee /etc/udev/rules.d/99-cec-restrict.rules
sudo udevadm control --reload-rules && sudo udevadm trigger