CVE-2020-12768: 
Linux Kernel vulnerability analysis and mitigation

A disputed vulnerability (CVE-2020-12768) was discovered in the Linux kernel before version 5.6, specifically in the svm_cpu_uninit function within arch/x86/kvm/svm.c. The issue involves a memory leak in the KVM (Kernel-based Virtual Machine) implementation for AMD processors. This vulnerability was reported on May 9, 2020. The issue is disputed because it's a one-time leak at boot, the size is negligible, and it can't be triggered at will (SUSE Bugzilla).

The vulnerability stems from a memory leak in the svm_cpu_uninit function within the KVM implementation for AMD processors. The issue occurs during CPU initialization where memory is not properly deallocated. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium), with attack vector being Local, attack complexity Low, and privileges required Low (Ubuntu).

The impact of this vulnerability is considered minimal. Since it's a one-time leak at boot, the size is negligible, and it cannot be triggered at will, the primary concern is a potential denial of service condition. A local attacker could possibly use this to cause a denial of service, though the practical impact is disputed (Ubuntu USN-4411-1).

The exploitability of this vulnerability is limited. It's a one-time leak that occurs at boot and cannot be triggered at will by attackers. The vulnerability requires local access and low privileges to potentially exploit (SUSE Bugzilla).

The vulnerability was fixed in Linux kernel 5.6 with commit d80b64ff297e. The fix addresses the memory leak by properly deallocating memory in the svm_cpu_uninit function. Various Linux distributions have backported the fix, including Ubuntu in versions 5.4.0-40.44 for 20.04 LTS and 5.3.0-62.56 for 19.10, and Debian in version 4.19.118-2+deb10u1 (Kernel Commit, Debian DSA-4699).