Skip to content
Fencer Intel
medium 5.5

CVE-2020-8694 json

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable i…

published 5y ago modified 4mo ago also EUVD-2020-29542

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Patch / fix

  • linux Debian 14, Debian 13, Debian 12 5.9.9-1

debian advisories DEBIAN-CVE-2020-8694

  • linux Ubuntu 16.04 LTS 4.4.0-194.226
  • linux Ubuntu 18.04 LTS 4.15.0-123.126
  • linux Ubuntu 20.04 LTS 5.4.0-53.59
  • linux-gcp Ubuntu 16.04 LTS 4.15.0-1087.100~16.04.1
  • linux-gcp Ubuntu 20.04 LTS 5.4.0-1029.31
  • linux-hwe Ubuntu 16.04 LTS 4.15.0-123.126~16.04.1
  • linux-hwe Ubuntu 18.04 LTS 5.3.0-69.65
  • linux-oem Ubuntu 18.04 LTS 4.15.0-1101.112

ubuntu advisories UBUNTU-CVE-2020-8694

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • rootlesskit SLE Module for Containers 15 SP5, SLE Module for Containers 15 SP4, openSUSE Leap 15.5 +1 more 1.1.1-150000.1.3.3
  • docker SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +19 more 24.0.7_ce-150000.190.4
  • runc SLE Module for Containers 12 1.1.10-16.40.1
  • docker SLE Module for Containers 12 24.0.7_ce-98.103.1
  • containerd SLE Module for Containers 12 1.7.8-16.88.1
  • kernel-azure SLES for SAP 12 SP5, SLES 12 SP5 4.12.14-16.38.1
  • kernel-syms-azure SLES for SAP 12 SP5, SLES 12 SP5 4.12.14-16.38.1

suse advisories SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2023:4936-1SUSE-SU-2023:4625-1SUSE-SU-2020:3715-1SUSE-SU-2020:3713-1

  • spectre-meltdown-checker openSUSE Tumbleweed 26.36.0602723-1.1
  • docker-stable openSUSE Tumbleweed 24.0.9_ce-15.1
  • kernel-source openSUSE Tumbleweed 5.14.6-1.4
  • docker openSUSE Tumbleweed 24.0.7_ce-2.1
  • kernel-source openSUSE Tumbleweed 6.6.17-1.1
  • kernel-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
  • kernel-syms-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
  • kernel-rt_debug openSUSE Leap 15.2 5.3.18-lp152.3.5.1

opensuse advisories openSUSE-SU-2026:11242-1openSUSE-SU-2025:15589-1openSUSE-SU-2024:10728-1openSUSE-SU-2024:13469-1openSUSE-SU-2024:13704-1openSUSE-SU-2021:0242-1

  • intel-ucode Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 20201110-r0
  • intel-ucode Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 20201112-r0

alpine advisories ALPINE-CVE-2020-8694

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • linux-hardened Arch Linux 5.9.8.a-1
  • linux-zen Arch Linux 5.9.8.zen1-1
  • linux Arch Linux 5.9.8.arch1-1
  • linux-lts Arch Linux 5.4.77-1

arch linux advisories AVG-1269AVG-1273AVG-1274AVG-1275

Is CVE-2020-8694 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8694 updated cvss 5.5

kernel: Insufficient access control vulnerability in PowerCap Framework

  • Red Hat Enterprise Linux 7 kernel, bpftool, kernel-rt, kernel-rt-kvm, kernel-rt-trace, kernel-rt-debug-kvm, +1 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, kernel-alt, python-perf, kernel-kdump, kernel-tools, +4 more Red Hat Enterprise Linux 8 microcode_ctl
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-132-05 updated cvss 5.6

Siemens Industrial PCs and CNC devices

  • Siemens SIMATIC Field PG M5 <BIOS_V22.01.08
    affected: fixed in V22.01.08, mitigation support.industry.siemens.com
  • Siemens SIMATIC Field PG M6 <V26.01.08
    affected: fixed in V26.01.08, mitigation support.industry.siemens.com
  • Siemens SIMATIC IPC427E (incl. SIPLUS variants) <BIOS_V21.01.15 Siemens SIMATIC IPC477E <BIOS_V21.01.15 Siemens SIMATIC IPC477E Pro <BIOS_V21.01.15
    affected: fixed in V21.01.15, mitigation support.industry.siemens.com
  • Siemens SIMATIC IPC527G <BIOS_V1.4.0
    affected: fixed in V1.4.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC IPC547G <R1.30.0
    affected: vendor fix, mitigation support.industry.siemens.com
  • Siemens SIMATIC IPC627E <BIOS_V25.02.08 Siemens SIMATIC IPC647E <BIOS_V25.02.08 Siemens SIMATIC IPC677E <BIOS_V25.02.08 Siemens SIMATIC IPC847E <BIOS_V25.02.08
    affected: fixed in V25.02.08, mitigation support.industry.siemens.com
  • Siemens SIMATIC ITP1000 <BIOS_V23.01.08
    affected: fixed in V23.01.08, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • n/a Intel(R) Processors

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.