Vulnerability-Lookup

BDU:2021-03057

Vulnerability from fstec - Published: 28.05.2020

Title

Уязвимость функции fill_thread_core_info() ядра операционной системы Linux, позволяющая нарушителю раскрыть защищаемую информацию и вызвать отказ в обслуживании

Description

Уязвимость функции fill_thread_core_info() ядра операционной системы Linux связана с раскрытием информации. Эксплуатация уязвимости может позволить нарушителю раскрыть защищаемую информацию и вызвать отказ в обслуживании

Severity ?


                    
                      AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Vendor

Red Hat Inc., Сообщество свободного программного обеспечения, Canonical Ltd., Novell Inc., АО "НППКТ"

Software Name

Red Hat Enterprise Linux, Debian GNU/Linux, Ubuntu, OpenSUSE Leap, ОСОН ОСнова Оnyx (запись в едином реестре российских программ №5913), Linux

Software Version

7 (Red Hat Enterprise Linux), 9 (Debian GNU/Linux), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 15.1 (OpenSUSE Leap), 14.04 ESM (Ubuntu), 10 (Debian GNU/Linux), 20.04 LTS (Ubuntu), 15.2 (OpenSUSE Leap), 16.04 ESM (Ubuntu), до 2.4 (ОСОН ОСнова Оnyx), от 4.8 до 4.9.225 включительно (Linux), от 4.10 до 4.14.182 включительно (Linux), от 4.15 до 4.19.125 включительно (Linux), от 4.20 до 5.4.43 включительно (Linux), от 5.5 до 5.6.15 включительно (Linux)

Possible Mitigations

Использование рекомендаций: Для Linux: https://lore.kernel.org/lkml/CAG_fn=VZZ7yUxtOGzuTLkr7wmfXWtKK9BHHYawj=rt9XWnCYvg@mail.gmail.com/ https://github.com/ruscur/linux/commit/a95cdec9fa0c08e6eeb410d461c03af8fd1fef0a https://github.com/google/kmsan/issues/76 https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.183 https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.126 https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.226 https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.44 https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.16 Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2020-10732 Для программных продуктов Novell Inc.: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BOYMLRUHWMVAOFIPZH7KANUUUY2YYNL3/ https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/Z6FEYXFXT2CJAAJJVCMBHT3BT2ZBZC3G/ Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/cve-2020-10732 Для Ubuntu: https://ubuntu.com/security/notices/USN-4411-1 https://ubuntu.com/security/notices/USN-4427-1 https://ubuntu.com/security/notices/USN-4439-1 https://ubuntu.com/security/notices/USN-4440-1 https://ubuntu.com/security/notices/USN-4485-1 Для ОСОН Основа: Обновление программного обеспечения linux до версии 5.14.9-2.osnova179.1

Reference

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html https://access.redhat.com/security/cve/cve-2020-10732 https://bugzilla.redhat.com/show_bug.cgi?id=1831399 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10732 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=aca969cacf07f41070d788ce2b8ca71f09d5207d https://github.com/google/kmsan/issues/76 https://github.com/ruscur/linux/commit/a95cdec9fa0c08e6eeb410d461c03af8fd1fef0a https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.183 https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.126 https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.226 https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.44 https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.16 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BOYMLRUHWMVAOFIPZH7KANUUUY2YYNL3/ https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/Z6FEYXFXT2CJAAJJVCMBHT3BT2ZBZC3G/ https://lore.kernel.org/lkml/20200419100848.63472-1-glider@google.com/ https://lore.kernel.org/lkml/CAG_fn=VZZ7yUxtOGzuTLkr7wmfXWtKK9BHHYawj=rt9XWnCYvg%40mail.gmail.com/ https://lore.kernel.org/lkml/CAG_fn=VZZ7yUxtOGzuTLkr7wmfXWtKK9BHHYawj=rt9XWnCYvg@mail.gmail.com/ https://lore.kernel.org/lkml/CAG48ez1u9=Uqcx2dH=7xea1R+WpnL239DSoVHLwV09=FxZUevQ@mail.gmail.com/#t https://security.netapp.com/advisory/ntap-20210129-0005/ https://security-tracker.debian.org/tracker/CVE-2020-10732 https://twitter.com/grsecurity/status/1252558055629299712 https://ubuntu.com/security/notices/USN-4411-1 https://ubuntu.com/security/notices/USN-4427-1 https://ubuntu.com/security/notices/USN-4439-1 https://ubuntu.com/security/notices/USN-4440-1 https://ubuntu.com/security/notices/USN-4485-1 https://usn.ubuntu.com/4411-1/ https://usn.ubuntu.com/4427-1/ https://usn.ubuntu.com/4439-1/ https://usn.ubuntu.com/4440-1/ https://usn.ubuntu.com/4485-1/ https://usn.ubuntu.com/usn/usn-4411-1 https://usn.ubuntu.com/usn/usn-4427-1 https://usn.ubuntu.com/usn/usn-4439-1 https://usn.ubuntu.com/usn/usn-4440-1 https://usn.ubuntu.com/usn/usn-4485-1 https://www.cve.org/CVERecord?id=CVE-2020-10732 https://www.openwall.com/lists/oss-security/2020/05/06/1 https://поддержка.нппкт.рф/bin/view/ОСнова/Обновления/2.4/

CWE

CWE-200, CWE-908

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:P/I:N/A:P",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, Canonical Ltd., Novell Inc., \u0410\u041e \"\u041d\u041f\u041f\u041a\u0422\"",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7 (Red Hat Enterprise Linux), 9 (Debian GNU/Linux), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 15.1 (OpenSUSE Leap), 14.04 ESM (Ubuntu), 10 (Debian GNU/Linux), 20.04 LTS (Ubuntu), 15.2 (OpenSUSE Leap), 16.04 ESM (Ubuntu), \u0434\u043e 2.4 (\u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx), \u043e\u0442 4.8 \u0434\u043e 4.9.225 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.10 \u0434\u043e 4.14.182 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.15 \u0434\u043e 4.19.125 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.20 \u0434\u043e 5.4.43 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.5 \u0434\u043e 5.6.15 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://lore.kernel.org/lkml/CAG_fn=VZZ7yUxtOGzuTLkr7wmfXWtKK9BHHYawj=rt9XWnCYvg@mail.gmail.com/\nhttps://github.com/ruscur/linux/commit/a95cdec9fa0c08e6eeb410d461c03af8fd1fef0a\nhttps://github.com/google/kmsan/issues/76\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.183\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.126\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.226\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.44\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.16\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2020-10732\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Novell Inc.:\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BOYMLRUHWMVAOFIPZH7KANUUUY2YYNL3/\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/Z6FEYXFXT2CJAAJJVCMBHT3BT2ZBZC3G/\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2020-10732\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/notices/USN-4411-1\nhttps://ubuntu.com/security/notices/USN-4427-1\nhttps://ubuntu.com/security/notices/USN-4439-1\nhttps://ubuntu.com/security/notices/USN-4440-1\nhttps://ubuntu.com/security/notices/USN-4485-1\n\n\u0414\u043b\u044f \u041e\u0421\u041e\u041d \u041e\u0441\u043d\u043e\u0432\u0430:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f linux \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 5.14.9-2.osnova179.1",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "28.05.2020",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "22.05.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "16.06.2021",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2021-03057",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2020-10732",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Debian GNU/Linux, Ubuntu, OpenSUSE Leap, \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913), Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat Inc. Red Hat Enterprise Linux 7 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux - , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 9 , Canonical Ltd. Ubuntu 18.04 LTS , Red Hat Inc. Red Hat Enterprise Linux 8 , Novell Inc. OpenSUSE Leap 15.1 , Canonical Ltd. Ubuntu 14.04 ESM , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , Canonical Ltd. Ubuntu 20.04 LTS , Novell Inc. OpenSUSE Leap 15.2 , Canonical Ltd. Ubuntu 16.04 ESM ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 fill_thread_core_info() \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (CWE-200), \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 (CWE-908)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 fill_thread_core_info() \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html\nhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html\nhttps://access.redhat.com/security/cve/cve-2020-10732\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1831399\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10732\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10732\nhttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=aca969cacf07f41070d788ce2b8ca71f09d5207d\nhttps://github.com/google/kmsan/issues/76\nhttps://github.com/ruscur/linux/commit/a95cdec9fa0c08e6eeb410d461c03af8fd1fef0a\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.183\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.126\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.226\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.44\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.16\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BOYMLRUHWMVAOFIPZH7KANUUUY2YYNL3/\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/Z6FEYXFXT2CJAAJJVCMBHT3BT2ZBZC3G/\nhttps://lore.kernel.org/lkml/20200419100848.63472-1-glider@google.com/\nhttps://lore.kernel.org/lkml/CAG_fn=VZZ7yUxtOGzuTLkr7wmfXWtKK9BHHYawj=rt9XWnCYvg%40mail.gmail.com/\nhttps://lore.kernel.org/lkml/CAG_fn=VZZ7yUxtOGzuTLkr7wmfXWtKK9BHHYawj=rt9XWnCYvg@mail.gmail.com/\nhttps://lore.kernel.org/lkml/CAG48ez1u9=Uqcx2dH=7xea1R+WpnL239DSoVHLwV09=FxZUevQ@mail.gmail.com/#t\nhttps://security.netapp.com/advisory/ntap-20210129-0005/\nhttps://security-tracker.debian.org/tracker/CVE-2020-10732\nhttps://twitter.com/grsecurity/status/1252558055629299712\nhttps://ubuntu.com/security/notices/USN-4411-1\nhttps://ubuntu.com/security/notices/USN-4427-1\nhttps://ubuntu.com/security/notices/USN-4439-1\nhttps://ubuntu.com/security/notices/USN-4440-1\nhttps://ubuntu.com/security/notices/USN-4485-1\nhttps://usn.ubuntu.com/4411-1/\nhttps://usn.ubuntu.com/4427-1/\nhttps://usn.ubuntu.com/4439-1/\nhttps://usn.ubuntu.com/4440-1/\nhttps://usn.ubuntu.com/4485-1/\nhttps://usn.ubuntu.com/usn/usn-4411-1\nhttps://usn.ubuntu.com/usn/usn-4427-1\nhttps://usn.ubuntu.com/usn/usn-4439-1\nhttps://usn.ubuntu.com/usn/usn-4440-1\nhttps://usn.ubuntu.com/usn/usn-4485-1\nhttps://www.cve.org/CVERecord?id=CVE-2020-10732\nhttps://www.openwall.com/lists/oss-security/2020/05/06/1\nhttps://\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430.\u043d\u043f\u043f\u043a\u0442.\u0440\u0444/bin/view/\u041e\u0421\u043d\u043e\u0432\u0430/\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f/2.4/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-200, CWE-908",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 3,2)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,4)"
}

CVE-2020-10732 (GCVE-0-2020-10732)

Vulnerability from cvelistv5 – Published: 2020-06-12 00:00 – Updated: 2024-08-04 11:14

Summary

A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.

Severity ?

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-908

Assigner

redhat

References

URL

Tags

	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	https://usn.ubuntu.com/4411-1/	vendor-advisory
	https://usn.ubuntu.com/4427-1/	vendor-advisory
	https://usn.ubuntu.com/4439-1/	vendor-advisory
	https://usn.ubuntu.com/4440-1/	vendor-advisory
	https://usn.ubuntu.com/4485-1/	vendor-advisory
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…
	https://git.kernel.org/pub/scm/linux/kernel/git/n…
	https://github.com/ruscur/linux/commit/a95cdec9fa…
	https://github.com/google/kmsan/issues/76
	https://twitter.com/grsecurity/status/12525580556…
	https://lore.kernel.org/lkml/CAG_fn=VZZ7yUxtOGzuT…
	https://security.netapp.com/advisory/ntap-2021012…

Impacted products

	Vendor	Product	Version
	Linux kernel	kernel	Affected: introduced in commit 4206d3aa1978e44f58bfa4e1c9d8d35cbf19c187

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:14:14.998Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2020:0801",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html"
          },
          {
            "name": "openSUSE-SU-2020:0935",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html"
          },
          {
            "name": "USN-4411-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4411-1/"
          },
          {
            "name": "USN-4427-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4427-1/"
          },
          {
            "name": "USN-4439-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4439-1/"
          },
          {
            "name": "USN-4440-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4440-1/"
          },
          {
            "name": "USN-4485-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4485-1/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10732"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=aca969cacf07f41070d788ce2b8ca71f09d5207d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ruscur/linux/commit/a95cdec9fa0c08e6eeb410d461c03af8fd1fef0a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/google/kmsan/issues/76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://twitter.com/grsecurity/status/1252558055629299712"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/lkml/CAG_fn=VZZ7yUxtOGzuTLkr7wmfXWtKK9BHHYawj=rt9XWnCYvg%40mail.gmail.com/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210129-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kernel",
          "vendor": "Linux kernel",
          "versions": [
            {
              "status": "affected",
              "version": "introduced in commit 4206d3aa1978e44f58bfa4e1c9d8d35cbf19c187"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the Linux kernel\u0027s implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-07T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "openSUSE-SU-2020:0801",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html"
        },
        {
          "name": "openSUSE-SU-2020:0935",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html"
        },
        {
          "name": "USN-4411-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4411-1/"
        },
        {
          "name": "USN-4427-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4427-1/"
        },
        {
          "name": "USN-4439-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4439-1/"
        },
        {
          "name": "USN-4440-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4440-1/"
        },
        {
          "name": "USN-4485-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4485-1/"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10732"
        },
        {
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=aca969cacf07f41070d788ce2b8ca71f09d5207d"
        },
        {
          "url": "https://github.com/ruscur/linux/commit/a95cdec9fa0c08e6eeb410d461c03af8fd1fef0a"
        },
        {
          "url": "https://github.com/google/kmsan/issues/76"
        },
        {
          "url": "https://twitter.com/grsecurity/status/1252558055629299712"
        },
        {
          "url": "https://lore.kernel.org/lkml/CAG_fn=VZZ7yUxtOGzuTLkr7wmfXWtKK9BHHYawj=rt9XWnCYvg%40mail.gmail.com/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210129-0005/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-10732",
    "datePublished": "2020-06-12T00:00:00.000Z",
    "dateReserved": "2020-03-20T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:14:14.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2021-03057

CVE-2020-10732 (GCVE-0-2020-10732)

Tags

Sightings

Nomenclature