CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-25221
https://notcve.org/view.php?id=CVE-2020-25221
get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743. La función get_gate_page en el archivo mm/gup.c en el kernel de Linux versiones 5.7.x y versiones 5.8.x anteriores a 5.8.7, permite una escalada de privilegios debido al conteo de referencias incorrecto (causado por el manejo inapropiado de una página de puerta) de la página de estructura que respalda la página vsyscall. El resultado es un subdesbordamiento del conteo. • http://www.openwall.com/lists/oss-security/2020/09/10/4 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7 https://git.kernel.org/linus/8891adc61dce2a8a41fc0c23262b681c3ec4b73a https://git.kernel.org/linus/9fa2dd946743ae6f30dc4830da19147bf100a7f2 https://security.netapp.com/advisory/ntap-20201001-0003 https://www.openwall.com/lists/oss-security/2020/09/08/4 • CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2020-15861
https://notcve.org/view.php?id=CVE-2020-15861
Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following. Net-SNMP versiones hasta 5.7.3, permite una Escalada de Privilegios debido al seguimiento de un enlace simbólico (symlink) de UNIX. • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=966599 https://github.com/net-snmp/net-snmp/commit/4fd9a450444a434a993bc72f7c3486ccce41f602 https://github.com/net-snmp/net-snmp/issues/145 https://security.gentoo.org/glsa/202008-12 https://security.netapp.com/advisory/ntap-20200904-0001 https://usn.ubuntu.com/4471-1 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 19EXPL: 2CVE-2020-14356 – kernel: Use After Free vulnerability in cgroup BPF component
https://notcve.org/view.php?id=CVE-2020-14356
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system. Se detectó un fallo de desreferencia de puntero null en el subsistema cgroupv2 del kernel de Linux en versiones anteriores a 5.7.10, en la manera de reiniciar el sistema. Un usuario local podría usar este fallo para bloquear el sistema o escalar sus privilegios en el sistema. A use-after-free flaw was found in the Linux kernel’s cgroupv2 subsystem when rebooting the system. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html https://bugzilla.kernel.org/show_bug.cgi?id=208003 https://bugzilla.redhat.com/show_bug.cgi?id=1868453 https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html https://lore.kernel.org/netdev/C • CWE-416: Use After Free CWE-476: NULL Pointer Dereference •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2020-15862 – net-snmp: Improper Privilege Management in EXTEND MIB may lead to privileged commands execution
https://notcve.org/view.php?id=CVE-2020-15862
Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root. Net-SNMP versiones hasta 5.7.3, presenta una Administración de Privilegios Inapropiada porque el acceso de SNMP WRITE en el EXTEND MIB provee la capacidad de ejecutar comandos arbitrarios como root. A flaw was found in Net-SNMP through version 5.73, where an Improper Privilege Management issue occurs due to SNMP WRITE access to the EXTEND MIB allows running arbitrary commands as root. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965166 https://github.com/net-snmp/net-snmp/commit/77f6c60f57dba0aaea5d8ef1dd94bcd0c8e6d205 https://salsa.debian.org/debian/net-snmp/-/commit/fad8725402752746daf0a751dcff19eb6aeab52e https://security-tracker.debian.org/tracker/CVE-2020-15862 https://security.gentoo.org/glsa/202008-12 https://security.netapp.com/advisory/ntap-20200904-0001 https://usn.ubuntu.com/4471-1 https://access.redhat.com/security/cve/CVE-2020-15862 https://bugzilla.redhat.co • CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 21EXPL: 0CVE-2020-16166 – kernel: information exposure in drivers/char/random.c and kernel/time/timer.c
https://notcve.org/view.php?id=CVE-2020-16166
The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c. El kernel de Linux versiones hasta 5.7.11, permite a atacantes remotos realizar observaciones que ayudan a obtener información confidencial sobre el estado interno de la red RNG, también se conoce como CID-f227e3ec3b5c. Esto está relacionado con los archivos drivers/char/random.c y kernel/time/timer.c A flaw was found in the Linux kernel. The generation of the device ID from the network RNG internal state is predictable. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html https://arxiv.org/pdf/2012.07432.pdf https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f227e3ec3b5cad859ad15666874405e8c1bbc1d4 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c51f8f88d705e06bd696d7510aff22b33eb8e638 https://github.com/torvalds/linux/commit/f227e3ec3b5cad859ad15666874405e8c1bbc1d4 https://lists.debian& • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-330: Use of Insufficiently Random Values •