Vulnerability · Published May 11, 2020 · Assigned by zephyr
CVE-2020-10058Multiple Syscalls In kscan Subsystem Performs No Argument Validation
High 7.8
In plain English
A high-severity improper input validation in zephyr from zephyrproject-rtos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.4%top 66.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges. See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zephyrproject-rtos | zephyr | 2.1.0 – before unspecified |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/zephyrproject-rtos/zephyr/pull/23308 x_refsource_MISC
- https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-34 x_refsource_MISC
- https://github.com/zephyrproject-rtos/zephyr/pull/23748 x_refsource_MISC
- https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10058 x_refsource_MISC