Log in Start free

Vulnerability · Published Sep 16, 2020 · Assigned by redhat

CVE-2020-10781

Medium 5.5

In plain English

A medium-severity incorrect permission assignment in kernel from Linux Kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 75.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.7.10-1DEBIAN-CVE-2020-10781
Debian:13linux5.7.10-1DEBIAN-CVE-2020-10781
Debian:14linux5.7.10-1DEBIAN-CVE-2020-10781
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2020-10781
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2020-10781
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2020-10781

Affected products (as reported)

VendorProductVersions
Linux Kernel kernel before 5.8-rc6

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References