Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26,253

Export CSV
CVE-2020-27825

kernel: use-after-free in the ftrace ring buffer resizing logic due to a race condition

A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel Cloud Backup and 6 more
CVE-2020-27820

kernel: use-after-free in nouveau kernel module

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver).

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Oracle and 1 more
Products
Fedora Linux Kernel Communications Cloud Native Core Binding Support Function and 3 more
CVE-2020-27815

kernel: Array index out of bounds access when setting extended attributes on journaling filesystems.

A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel Aff A250 and 19 more
CVE-2020-27786

kernel: use-after-free in kernel midi subsystem

A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 7.8 High EPSS 1.7% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Cloud Backup Solidfire Baseboard Management Controller and 3 more
CVE-2020-27784

kernel: deallocated instance in printer_ioctl() printer_ioctl() tries to access lock_printer_io of the printer_dev instance

A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had been freed by gprinter_free().

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2020-27777

kernel: powerpc: RTAS calls can be used to compromise kernel integrity

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Openshift Container Platform
CVE-2020-27675

kernel: xen: race condition in event-channel removal during the event-handling loop (XSA-331)

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux
Products
Debian Linux Fedora Linux Kernel
CVE-2020-27673

kernel: xen: guest OS users can cause a DoS via a high rate of events to dom0 (XSA-332)

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Opensuse and 1 more
Products
Debian Linux Linux Kernel Leap and 1 more
CVE-2020-27194

kernel: bounds tracking issue during use of 64-bit values in scalar32_min_max_or function in kernel/bpf/verifier.c

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a.

CVSS 3.1 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2020-27152

Kernel: KVM: host stack overflow due to lazy update IOAPIC

An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2020-26541

kernel: security bypass in certs/blacklist.c and certs/system_keyring.c

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus and 1 more
CVE-2020-26088

kernel: missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c allows local attackers to create raw sockets

A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more
CVE-2020-25705

kernel: ICMP rate limiting can be used for DNS poisoning attack

A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version

CVSS 3.1 · 7.4 High EPSS 6.7% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Aus and 4 more
CVE-2020-25704

kernel: perf_event_parse_addr_filter memory

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat and 1 more
Products
Debian Linux Linux Kernel Enterprise Linux and 6 more
CVE-2020-25671

kernel: refcount leak in llcp_sock_connect()

A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which might lead to privilege escalations.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 20 more
CVE-2020-25669

kernel: use-after-free read in sunkbd_reinit in drivers/input/keyboard/sunkbd.c

A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel Cloud Backup and 18 more
CVE-2020-25668

kernel: race condition in fg_console can lead to use-after-free in con_font_op

A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.

CVSS 3.1 · 7.0 High EPSS 1.0% KEV · Not listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel 500f and 23 more