Risk | High |
Patch available | YES |
Number of vulnerabilities | 11 |
CVE-ID | CVE-2019-19807 CVE-2019-20908 CVE-2020-10713 CVE-2020-10757 CVE-2020-10766 CVE-2020-10767 CVE-2020-10768 CVE-2020-12653 CVE-2020-12654 CVE-2020-12888 CVE-2020-15780 |
CWE-ID | CWE-416 CWE-276 CWE-787 CWE-269 CWE-362 CWE-399 CWE-20 CWE-264 CWE-285 |
Exploitation vector | Network |
Public exploit |
Public exploit code for vulnerability #3 is available. Public exploit code for vulnerability #11 is available. |
Vulnerable software |
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support Operating systems & Components / Operating system Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support Operating systems & Components / Operating system Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support Operating systems & Components / Operating system Red Hat Enterprise Linux for ARM 64 - Extended Update Support Operating systems & Components / Operating system Red Hat Enterprise Linux for Power, little endian - Extended Update Support Operating systems & Components / Operating system Red Hat Enterprise Linux for IBM z Systems - Extended Update Support Operating systems & Components / Operating system Red Hat Enterprise Linux for x86_64 - Extended Update Support Operating systems & Components / Operating system kernel (Red Hat package) Operating systems & Components / Operating system package or component |
Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 11 vulnerabilities.
EUVDB-ID: #VU30551
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-19807
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local authenticated user to execute arbitrary code.
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.
MitigationInstall updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU34141
Risk: Low
CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-20908
CWE-ID:
CWE-276 - Incorrect Default Permissions
Exploit availability: No
DescriptionThe vulnerability allows a local privileged user to execute arbitrary code.
An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032.
MitigationInstall updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU32922
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2020-10713
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: Yes
Description
The vulnerability allows a local attacker to compromise vulnerable system.
The vulnerability exists due to a "BootHole" issue. An attacker with physical access can install persistent and stealthy bootkits or malicious bootloaders, trigger out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU29957
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-10757
CWE-ID:
CWE-269 - Improper Privilege Management
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.
MitigationInstall updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU47074
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-10766
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
A logic bug flaw was found in Linux kernel before 5.8-rc1 in the
implementation of SSBD. A bug in the logic handling allows an attacker
with a local account to disable SSBD protection during a context switch
when additional speculative execution mitigations are in place. This
issue was introduced when the per task/process conditional STIPB
switching was added on top of the existing SSBD switching.
Install updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU47075
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-10767
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
A flaw was found in the Linux kernel before 5.8-rc1 in the
implementation of the Enhanced IBPB (Indirect Branch Prediction
Barrier). The IBPB mitigation will be disabled when STIBP is not
available or when the Enhanced Indirect Branch Restricted Speculation
(IBRS) is available. This flaw allows a local user to perform a Spectre
V2 style attack when this configuration is active.
Install updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU47076
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-10768
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local authenticated user to gain access to sensitive information.
A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.
MitigationInstall updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU28164
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-12653
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in the "mwifiex_cmd_append_vsie_tlv()" function in "drivers/net/wireless/marvell/mwifiex/scan.c" file. A local user can gain elevated privileges on the target system.
MitigationInstall updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU28162
Risk: High
CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-12654
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in the "mwifiex_ret_wmm_get_status()" function in "drivers/net/wireless/marvell/mwifiex/wmm.c" file. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU28159
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-12888
CWE-ID: N/A
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a deinal of service (DoS) attack.
The vulnerability exists due to the VFIO PCI driver mishandles attempts to access disabled memory space. A local user can cause a denial of service condition on the target system.
MitigationInstall updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU31922
Risk: Low
CVSSv3.1: 6 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2020-15780
CWE-ID:
CWE-285 - Improper Authorization
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to bypass authorization checks.
The vulnerability exists due to improper authorization in "in drivers/acpi/acpi_configfs.c". A local administrator can inject malicious ACPI tables via configfs to bypass lockdown and secure boot restrictions.
MitigationInstall updates from vendor's website.
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support: 8.1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.1
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.1
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.1
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.1
kernel (Red Hat package): before 4.18.0-147.24.2.el8_1
CPE2.3http://access.redhat.com/errata/RHSA-2020:3222
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.