#VU47075 Resource management error in Linux kernel

Published: 2020-09-16 | Updated: 2020-09-26

Vulnerability identifier: #VU47075

Vulnerability risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10767


Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation


The vulnerability allows a local user to gain access to sensitive information.

A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local user to perform a Spectre V2 style attack when this configuration is active.

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.0 - 5.0.21, 5.1 - 5.1.21, 5.2 - 5.2.21, 5.3 - 5.3.18, 5.4 - 5.4.42, 5.5 - 5.5.19, 5.6 - 5.6.14, 5.7 - 5.7.7

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Latest bulletins with this vulnerability