Skip to content
Fencer Intel
high 7.8

CVE-2020-36787 json

media: aspeed: fix clock handling logic

published 2y ago modified 3mo ago also EUVD-2020-24228

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

media: aspeed: fix clock handling logic

Video engine uses eclk and vclk for its clock sources and its reset control is coupled with eclk so the current clock enabling sequence works like below.

Enable eclk De-assert Video Engine reset 10ms delay Enable vclk

It introduces improper reset on the Video Engine hardware and eventually the hardware generates unexpected DMA memory transfers that can corrupt memory region in random and sporadic patterns. This issue is observed very rarely on some specific AST2500 SoCs but it causes a critical kernel panic with making a various shape of signature so it's extremely hard to debug. Moreover, the issue is observed even when the video engine is not actively used because udevd turns on the video engine hardware for a short time to make a query in every boot.

To fix this issue, this commit changes the clock handling logic to make the reset de-assertion triggered after enabling both eclk and vclk. Also, it adds clk_unprepare call for a case when probe fails.

clk: ast2600: fix reset settings for eclk and vclk Video engine reset setting should be coupled with eclk to match it with the setting for previous Aspeed SoCs which is defined in clk-aspeed.c since all Aspeed SoCs are sharing a single video engine driver. Also, reset bit 6 is defined as 'Video Engine' reset in datasheet so it should be de-asserted when eclk is enabled. This commit fixes the setting.

Patch / fix

  • Linux Linux 5.4.119, 5.10.37, 5.11.21, 5.12.4, 5.13
  • linux Debian 14, Debian 13, Debian 12 5.10.38-1

debian advisories DEBIAN-CVE-2020-36787

  • linux Ubuntu 20.04 LTS 5.4.0-77.86
  • linux-aws Ubuntu 20.04 LTS 5.4.0-1051.53
  • linux-gcp Ubuntu 20.04 LTS 5.4.0-1046.49
  • linux-kvm Ubuntu 20.04 LTS 5.4.0-1041.42
  • linux-azure Ubuntu 20.04 LTS 5.4.0-1051.53
  • linux-gkeop Ubuntu 20.04 LTS 5.4.0-1018.19
  • linux-raspi Ubuntu 20.04 LTS 5.4.0-1038.41
  • linux-oracle Ubuntu 20.04 LTS 5.4.0-1048.52

ubuntu advisories UBUNTU-CVE-2020-36787

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2020-36787 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-36787 updated cvss 6.0

kernel: media: aspeed: fix clock handling logic

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2y ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.