CVE-2020-14386 Vulnerability Fix Announcement

Updated at：2025-10-27

Vulnerability description

Recently, Baidu AI Cloud's security team identified a privilege escalation vulnerability (CVE-2020-14386) in Linux distribution versions. For details, refer to CVE-2020-14386. Attackers can exploit this vulnerability to perform out-of-bounds write operations, which may lead to permission escalation, container escape, and system crashes due to memory access errors.

This vulnerability exists in the net/packet/af_packet.c file, and its triggering requires a local user with low permission or executable file with CAP_NET_RAW permission. In general, non-root users have no CAP_NET_RAW permission. However, in higher versions of Linux, non-root users can become root users in a new user namespace by creating a user namespace, thereby gaining this permission. Moreover, docker containers created by K8S are granted CAP_NET_RAW permission by default, thereby presenting possibility of triggering vulnerability.

Vulnerability number: CVE-2020-14386
Vulnerability level: high risk

Scope of impact

Linux kernel 4.6 to 5.9-rc4

Affected system distribution:

Ubuntu 18.04 and higher
Centos 8/RHEL 8
Debian 9/10

Relevant security recommendations

Upgrade the Linux Kernel version or remove the container's CAP_NET_RAW permission.

Upgrade the Linux Kernel version

Upgrade the kernel to a secure version or apply the fix patch
Download address of kernel: https://github.com/torvalds/linux/releases
Patch address:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=acf69c946233259ab4d64f8869d4037a198c7f06

Disable container CAP_NET_RAW permission

Modify the container's spec configuration to remove the CAP_NET_RAW permission.

Plain Text

1spec:
2containers:
3    - name: your-container
4      ...
5      securityContext:
6          capabilities:
7              drop: ["NET_RAW"]

Typically, containers don't need the CAP_NET_RAW permission. After configuring PodSecurityPolicy (PSP) in K8S, you can use PSP policies to revoke the CAP_NET_RAW permission from containers.
Plain Text
```
1apiVersion: policy/v1beta1
2kind: PodSecurityPolicy
3metadata:
4 name: mypsp
5spec:
6 ...
7 requiredDropCapabilities:
8   - 'NET_RAW'
```

CVE-2025-1097, CVE-2025-1098, and Other Vulnerabilities Fix Announcement

Impact Statement on runc Security Issue (CVE-2024-21626)

CCE CCE