Use-after-free in Linux kernel - CVE-2020-10720
Published: September 3, 2020 / Updated: September 18, 2020
Vulnerability identifier: #VU46586
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-10720
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.
A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with local access to crash the system.
Affected software
Linux kernel
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
kernel-alt (Red Hat package)
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
kernel-alt (Red Hat package)
How to mitigate CVE-2020-10720
Install update from vendor's website.
Linux kernel - update to 5.2
kernel-alt (Red Hat package) - update to 4.14.0-115.26.1.el7a
kernel-alt (Red Hat package) - update to 4.14.0-115.26.1.el7a