Improper Initialization in Linux kernel - CVE-2020-35508

Vulnerability identifier: #VU55259

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-35508

CWE-ID: CWE-665

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper initialization of the process id in the Linux kernel child/parent process identification handling while filtering signal handlers. A local user can run a specially crafted application to bypass checks to send any signal to a privileged process.

Linux kernel
Anolis OS
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Server - TUS
Ubuntu
kernel-rt (Red Hat package)
kernel (Red Hat package)
kernel-headers
bpftool
kernel
kernel-core
kernel-cross-headers
kernel-debug
kernel-debug-core
kernel-debug-devel
kernel-debug-modules
kernel-debug-modules-extra
kernel-devel
kernel-modules
kernel-modules-extra
kernel-tools
kernel-tools-libs
perf
python3-perf
kernel-abi-whitelists
kernel-doc
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.6.0-1048-oem (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-5.8.0-44-generic-64k (Ubuntu package)
linux-image-5.8.0-44-generic (Ubuntu package)
linux-image-5.8.0-44-generic-lpae (Ubuntu package)
linux-image-5.8.0-44-lowlatency (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-5.8.0-1016-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.8.0-1016-raspi-nolpae (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-5.8.0-1019-kvm (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-5.8.0-1021-oracle (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-5.8.0-1023-gcp (Ubuntu package)
linux-image-5.8.0-1023-azure (Ubuntu package)
linux-image-5.8.0-1024-aws (Ubuntu package)
linux-image-aws (Ubuntu package)
IBM Elastic Storage System

Install updates from vendor's website.

Linux kernel - update to 5.12
kernel-rt (Red Hat package) - update to 4.18.0-193.60.2.rt13.112.el8_2
kernel (Red Hat package) - update to 4.18.0-193.60.2.el8_2
IBM Elastic Storage System - addressed in versions 6.0.2.3, 6.1.2
kernel-headers - update to 4.18.0-193.60.2
bpftool - update to 4.18.0-193.60.2
kernel - update to 4.18.0-193.60.2
kernel-core - update to 4.18.0-193.60.2
kernel-cross-headers - update to 4.18.0-193.60.2
kernel-debug - update to 4.18.0-193.60.2
kernel-debug-core - update to 4.18.0-193.60.2
kernel-debug-devel - update to 4.18.0-193.60.2
kernel-debug-modules - update to 4.18.0-193.60.2
kernel-debug-modules-extra - update to 4.18.0-193.60.2
kernel-devel - update to 4.18.0-193.60.2
kernel-modules - update to 4.18.0-193.60.2
kernel-modules-extra - update to 4.18.0-193.60.2
kernel-tools - update to 4.18.0-193.60.2
kernel-tools-libs - update to 4.18.0-193.60.2
perf - update to 4.18.0-193.60.2
python3-perf - update to 4.18.0-193.60.2
kernel-abi-whitelists - update to 4.18.0-193.60.2
kernel-doc - update to 4.18.0-193.60.2
linux-image-oem-20.04 (Ubuntu package) - addressed in versions 5.6.0.1048.44, 5.8.0.44.49
linux-image-5.6.0-1048-oem (Ubuntu package) - update to 5.6.0-1048.52
linux-image-generic-lpae (Ubuntu package) - update to 5.8.0.44.49
linux-image-lowlatency (Ubuntu package) - update to 5.8.0.44.49
linux-image-virtual (Ubuntu package) - update to 5.8.0.44.49
linux-image-generic-64k (Ubuntu package) - update to 5.8.0.44.49
linux-image-generic (Ubuntu package) - update to 5.8.0.44.49
linux-image-5.8.0-44-generic-64k (Ubuntu package) - update to 5.8.0-44.50
linux-image-5.8.0-44-generic (Ubuntu package) - update to 5.8.0-44.50~20.04.1
linux-image-5.8.0-44-generic-lpae (Ubuntu package) - update to 5.8.0-44.50~20.04.1
linux-image-5.8.0-44-lowlatency (Ubuntu package) - update to 5.8.0-44.50~20.04.1
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-5.8.0-1016-raspi (Ubuntu package) - update to 5.8.0-1016.19
linux-image-raspi-nolpae (Ubuntu package) - update to 5.8.0.1016.19
linux-image-raspi (Ubuntu package) - update to 5.8.0.1016.19
linux-image-5.8.0-1016-raspi-nolpae (Ubuntu package) - update to 5.8.0-1016.19
linux-image-kvm (Ubuntu package) - update to 5.8.0.1019.21
linux-image-5.8.0-1019-kvm (Ubuntu package) - update to 5.8.0-1019.21
linux-image-oracle (Ubuntu package) - update to 5.8.0.1021.20
linux-image-5.8.0-1021-oracle (Ubuntu package) - update to 5.8.0-1021.22
linux-image-azure (Ubuntu package) - update to 5.8.0.1023.23
linux-image-gcp (Ubuntu package) - update to 5.8.0.1023.23
linux-image-gke (Ubuntu package) - update to 5.8.0.1023.23
linux-image-5.8.0-1023-gcp (Ubuntu package) - update to 5.8.0-1023.24
linux-image-5.8.0-1023-azure (Ubuntu package) - update to 5.8.0-1023.25
linux-image-5.8.0-1024-aws (Ubuntu package) - update to 5.8.0-1024.26
linux-image-aws (Ubuntu package) - update to 5.8.0.1024.26

• https://github.com/torvalds/linux/commit/b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948
• https://bugzilla.redhat.com/show_bug.cgi?id=1902724
• https://security.netapp.com/advisory/ntap-20210513-0006/

• Security restrictions bypass in Linux kernel
• Red Hat Enterprise Linux 8.2 update for kernel
• Red Hat Enterprise Linux for Real Time 8.2 update for kernel-rt
• Multiple vulnerabilities in IBM Elastic Storage System
• Ubuntu update for linux-oem-5.6
• Ubuntu update for linux
• Anolis OS update for kernel