CVSS: 4.1EPSS: 0%CPEs: 4EXPL: 0CVE-2020-25284 – kernel: incomplete permission checking for access to rbd devices
https://notcve.org/view.php?id=CVE-2020-25284
The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe. El controlador de dispositivo del bloque rbd en el archivo drivers/block/rbd.c en el kernel de Linux versiones hasta 5.8.9, usaba una comprobación incompleta de permisos para acceder a dispositivos rbd, que podrían ser aprovechados por atacantes locales para asignar o desasignar dispositivos de bloque rbd, también se conoce como CID-f44d04e696fe A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel. Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add or remove Rados Block Devices from the system. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f44d04e696feaf13d192d942c4f14ad2e117065a https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html https://twitter.com/grsecurity/ • CWE-732: Incorrect Permission Assignment for Critical Resource CWE-863: Incorrect Authorization •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2020-25285 – kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c
https://notcve.org/view.php?id=CVE-2020-25285
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812. Una condición de carrera entre los manejadores hugetlb sysctl en el archivo mm/hugetlb.c en el kernel de Linux versiones anteriores a 5.8.8, podría ser usada por atacantes locales para corromper la memoria, causar una desreferencia del puntero NULL o posiblemente tener otro impacto no especificado, también se conoce como CID-17743798d812 A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on internal variables leading to a system crash or memory corruption. • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.8 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17743798d81238ab13050e8e2833699b54e15467 https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html https://security.netapp.com/advisory/ntap-20201009-0002 https://twitter.com/grsecurity/status/1303749848898904067 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-476: NULL Pointer Dereference CWE-787: Out-of-bounds Write •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10773 – kernel: kernel stack information leak on s390/s390x
https://notcve.org/view.php?id=CVE-2020-10773
A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This flaw allows a local user to see the kernel data. Se encontró un fallo de filtrado de información de la pila en s390/s390x en la funcionalidad del administrador de memoria del kernel de Linux, donde escribe incorrectamente en el archivo /proc/sys/vm/cmm_timeout. Este fallo permite a un usuario local visualizar los datos del kernel • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10773 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f https://access.redhat.com/security/cve/CVE-2020-10773 https://bugzilla.redhat.com/show_bug.cgi?id=1846380 • CWE-626: Null Byte Interaction Error (Poison Null Byte) •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-25221
https://notcve.org/view.php?id=CVE-2020-25221
get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743. La función get_gate_page en el archivo mm/gup.c en el kernel de Linux versiones 5.7.x y versiones 5.8.x anteriores a 5.8.7, permite una escalada de privilegios debido al conteo de referencias incorrecto (causado por el manejo inapropiado de una página de puerta) de la página de estructura que respalda la página vsyscall. El resultado es un subdesbordamiento del conteo. • http://www.openwall.com/lists/oss-security/2020/09/10/4 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7 https://git.kernel.org/linus/8891adc61dce2a8a41fc0c23262b681c3ec4b73a https://git.kernel.org/linus/9fa2dd946743ae6f30dc4830da19147bf100a7f2 https://security.netapp.com/advisory/ntap-20201001-0003 https://www.openwall.com/lists/oss-security/2020/09/08/4 • CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 7.0EPSS: 0%CPEs: 8EXPL: 0CVE-2020-25212 – kernel: TOCTOU mismatch in the NFS client code
https://notcve.org/view.php?id=CVE-2020-25212
A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. Una discrepancia de TOCTOU en el código del cliente NFS en el kernel de Linux versiones anteriores a 5.8.3, podría ser usada por atacantes locales para dañar la memoria o posiblemente tener otro impacto no especificado porque una comprobación de tamaño se encuentra en el archivo fs/nfs/nfs4proc.c en lugar de fs/nfs/nfs4xdr.c, también se conoce como CID-b4487b935452. A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response allow for local memory corruption and possibly privilege escalation. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00042.html https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.3 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b4487b93545214a9db8cbf32e86411677b0cca21 https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html https://lists.debian.org&#x • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition CWE-787: Out-of-bounds Write •