CVSS: 7.4EPSS: 0%CPEs: 3EXPL: 1CVE-2020-25705 – kernel: ICMP rate limiting can be used for DNS poisoning attack
https://notcve.org/view.php?id=CVE-2020-25705
A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version Se encontró un fallo en los paquetes ICMP en el kernel de Linux puede permitir a un atacante escanear rápidamente los puertos UDP abiertos. Este defecto permite a un atacante remoto fuera de la ruta eludir efectivamente la aleatorización del puerto de origen UDP. • https://github.com/tdwyer/CVE-2020-25705 https://us-cert.cisa.gov/ics/advisories/icsa-21-131-03 https://access.redhat.com/security/cve/CVE-2020-25705 https://bugzilla.redhat.com/show_bug.cgi?id=1894579 • CWE-330: Use of Insufficiently Random Values •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-27152 – Kernel: KVM: host stack overflow due to lazy update IOAPIC
https://notcve.org/view.php?id=CVE-2020-27152
An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9. Se detectó un problema en la función ioapic_lazy_update_eoi en el archivo arch/x86/kvm/ioapic.c en el kernel de Linux versiones anteriores a 5.9.2. Presenta un bucle infinito relacionado con la interacción inapropiada entre el remuestreador y la activación de borde, también se conoce como CID-77377064c3a9 A stack overflow flaw via an infinite loop condition issue was found in the KVM hypervisor of the Linux kernel. This flaw occurs while processing interrupts because the IRQ state is erroneously set. • http://www.openwall.com/lists/oss-security/2020/11/03/1 https://bugzilla.kernel.org/show_bug.cgi?id=208767 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.2 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=77377064c3a94911339f13ce113b3abf265e06da https://access.redhat.com/security/cve/CVE-2020-27152 https://bugzilla.redhat.com/show_bug.cgi?id=1888886 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 4.7EPSS: 0%CPEs: 5EXPL: 0CVE-2020-27675
https://notcve.org/view.php?id=CVE-2020-27675
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5. Se detectó un problema en el kernel de Linux versiones hasta 5.9.1, como es usado con Xen versiones hasta 4.14.x. El archivo drivers/xen/events/events_base.c permite la eliminación del canal de eventos durante el ciclo de manejo de eventos (una condición de carrera). Esto puede causar una desreferencia del puntero NULL y un uso de la memoria previamente liberada como es demostrado por un bloqueo dom0 por medio de eventos para un dispositivo paravirtualizado en reconfiguración, también se conoce como CID-073d0552ead5 • http://www.openwall.com/lists/oss-security/2021/01/19/3 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073d0552ead5bfc7a3a9c01de590e924f11b5dd2 https://github.com/torvalds/linux/commit/073d0552ead5bfc7a3a9c01de590e924f11b5dd2 https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ZG6TZLD23QO3PV2AN2HB625ZX47ALTT https:/&#x • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 2CVE-2020-27194
https://notcve.org/view.php?id=CVE-2020-27194
An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a. Se detectó un problema en el kernel de Linux versiones anteriores a 5.8.15. La función scalar32_min_max_or en el archivo kernel/bpf/verifier.c, maneja inapropiadamente el seguimiento de límites durante el uso de valores de 64 bits, también se conoce como CID-5b9fbeb75b6a • https://github.com/xmzyshypnc/CVE-2020-27194 https://github.com/willinin/CVE-2020-27194-exp https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.15 https://github.com/torvalds/linux/commit/5b9fbeb75b6a98955f628e205ac26689bcb1383e • CWE-681: Incorrect Conversion between Numeric Types •
CVSS: 5.1EPSS: 0%CPEs: 5EXPL: 0CVE-2020-16120 – Unprivileged overlay + shiftfs read access
https://notcve.org/view.php?id=CVE-2020-16120
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. • https://git.kernel.org/linus/05acefb4872dae89e772729efb194af754c877e8 https://git.kernel.org/linus/48bd024b8a40d73ad6b086de2615738da0c7004f https://git.kernel.org/linus/56230d956739b9cb1cbde439d76227d77979a04d https://git.kernel.org/linus/b6650dab404c701d7fe08a108b746542a934da84 https://git.kernel.org/linus/d1d04ef8572bc8c22265057bd3d5a79f223f8f52 https://launchpad.net/bugs/1894980 https://launchpad.net/bugs/1900141 https://ubuntu.com/USN-4576-1 https://ubuntu.com/USN-4577-1 https://ubuntu.com/USN-4578-1 https://www.openwall • CWE-266: Incorrect Privilege Assignment •