CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 1CVE-2020-15780 – kernel: lockdown: bypass through ACPI write via acpi_configfs
https://notcve.org/view.php?id=CVE-2020-15780
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30. Se detectó un problema en el archivo drivers/acpi/acpi_configfs.c en el kernel de Linux versiones anteriores a 5.7.7. Una inyección de tablas ACPI maliciosas por medio de configfs podría ser usada por atacantes para omitir el bloqueo y asegurar las restricciones de arranque, también se conoce como CID-75b0cea7bf30 A flaw was found in how the ACPI table loading through acpi_configfs was handled when the kernel was locked down. This flaw allows a (root) privileged local user to circumvent the kernel lockdown restrictions. • https://github.com/Annavid/CVE-2020-15780-exploit http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html http://www.openwall.com/lists/oss-security/2020/07/20/7 http://www.openwall.com/lists/oss-security/2020/07/29/3 http://www.openwall.com/lists/oss-security/2020/07/30/2 http://www.openwall.com/lists/oss-security/2020/07/30/3 https://cdn.kernel.org/pub/linux/kernel&# • CWE-284: Improper Access Control CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2020-14713
https://notcve.org/view.php?id=CVE-2020-14713
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html https://security.gentoo.org/glsa/202101-09 https://www.oracle.com/security-alerts/cpujul2020.html •
CVSS: 4.4EPSS: 0%CPEs: 5EXPL: 0CVE-2020-14714
https://notcve.org/view.php?id=CVE-2020-14714
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html https://security.gentoo.org/glsa/202101-09 https://www.oracle.com/security-alerts/cpujul2020.html •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-14707
https://notcve.org/view.php?id=CVE-2020-14707
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html https://security.gentoo.org/glsa/202101-09 https://www.oracle.com/security-alerts/cpujul2020.html •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-14712
https://notcve.org/view.php?id=CVE-2020-14712
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html https://security.gentoo.org/glsa/202101-09 https://www.oracle.com/security-alerts/cpujul2020.html •