CVE-2020-8617

A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c

Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.

CVSS 3.1 · 7.5 High EPSS 93.3% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 7 more

CVE-2020-8616

BIND does not sufficiently limit the number of fetches performed when processing referrals

A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.

CVSS 3.1 · 8.6 High EPSS 10.9% KEV · Not listed

Vendors

Debian Isc Redhat

Products

Debian Linux Bind Enterprise Linux and 4 more

CVE-2020-5208

remote code execution vulnerability in ipmitool

It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.

CVSS 3.1 · 7.7 High EPSS 3.3% KEV · Not listed

Vendors

Debian Fedoraproject Ipmitool Project and 2 more

Products

Debian Linux Fedora Ipmitool and 6 more

CVE-2020-36385

kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free

An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed

Vendors

Linux Netapp Redhat and 1 more

Products

Linux Kernel H300e H300e Firmware and 23 more

CVE-2020-29661

kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Broadcom Debian Fedoraproject and 4 more

Products

Fabric Operating System Debian Linux Fedora and 22 more

CVE-2020-28374

kernel: SCSI target (LIO) write to any block on ILO backstore

In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.

CVSS 3.1 · 8.1 High EPSS 6.6% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 6 more

CVE-2020-27779

grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled

A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more

CVE-2020-27749

grub2: Stack buffer overflow in grub_parser_split_cmdline()

A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more

CVE-2020-25705

kernel: ICMP rate limiting can be used for DNS poisoning attack

A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version

CVSS 3.1 · 7.4 High EPSS 6.7% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Aus and 4 more

CVE-2020-25647

grub2: Out-of-bounds write in grub_usb_device_initialize()

A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more

CVE-2020-25632

grub2: Use-after-free in rmmod command

A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.2 High EPSS 1.2% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more

CVE-2020-25212

kernel: TOCTOU mismatch in the NFS client code

A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2020-25211

kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c

In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 6 more

CVE-2020-24394

kernel: umask not applied on filesystem without ACL support

In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Opensuse and 3 more

Products

Ubuntu Linux Linux Kernel Leap and 8 more

CVE-2020-22219

flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder

Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Flac Project Redhat

Products

Flac Enterprise Linux Rhel Aus and 3 more

CVE-2020-15862

net-snmp: Improper Privilege Management in EXTEND MIB may lead to privileged commands execution

Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Net-snmp Netapp and 1 more

Products

Ubuntu Linux Net-snmp Cloud Backup and 8 more

CVE-2020-15707

GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.

CVSS 3.1 · 5.7 Medium EPSS 1.6% KEV · Not listed

Vendors

Canonical Debian Gnu and 5 more

Products

Ubuntu Linux Debian Linux Grub2 and 16 more

CVE-2020-15706

GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Gnu and 4 more

Products

Ubuntu Linux Debian Linux Grub2 and 15 more

CVE-2020-15705

GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.

CVSS 3.1 · 6.4 Medium EPSS 1.4% KEV · Not listed

Vendors

Canonical Debian Gnu and 4 more

Products

Ubuntu Linux Debian Linux Grub2 and 15 more

CVE-2020-14372

grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled

A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Cloud Backup and 10 more