PT-2020-6650 · Linux+7 · Linux Kernel+7

Publicado 2020-12-10 · Atualizado 2022-10-14 · CVE-2020-36322

Positive Technologies (AI Summary) · Pt

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Nome do software vulnerável e versões afetadas

Versões do kernel Linux anteriores à 5.10.6

Descrição

O problema está relacionado à implementação do sistema de arquivos FUSE no kernel Linux. Ele causa uma falha no sistema devido à função fuse do getattr() chamar make bad inode() em situações inadequadas. A vulnerabilidade está relacionada à limpeza incompleta de recursos temporários ou auxiliares, o que pode ser explorado por um invasor para causar uma negação de serviço usando um programa especialmente criado.

Recomendações

Para versões do kernel Linux anteriores à 5.10.6, atualize para a versão 5.10.6 ou posterior para resolver o problema.

No momento, não há informações sobre medidas de mitigação adicionais para esta vulnerabilidade.

Exploit

Correção

Improper Resource Release

Enumeração de Fraquezas

CWE-459

CWE-404

Identificadores relacionados

ALSA-2021:1578

ALT-PU-2021-1034

ALT-PU-2021-1051

ALT-PU-2021-1083

ALT-PU-2021-1099

ALT-PU-2021-1105

ALT-PU-2021-1446

ALT-PU-2021-1621

ALT-PU-2021-1656

ALT-PU-2021-1739

ALT-PU-2021-1862

ALT-PU-2021-1866

ALT-PU-2021-1870

BDU:2022-02505

CESA-2021_1578

CESA-2022_0063

CVE-2020-36322

DLA-2689-1

DLA-2941-1

DSA-5096-1

OESA-2021-1176

OPENSUSE-SU-2021:0579-1

OPENSUSE-SU-2021:1975-1

OPENSUSE-SU-2021:1977-1

OPENSUSE-SU-2021_0579-1

OPENSUSE-SU-2021_1975-1

OPENSUSE-SU-2021_1977-1

RHSA-2021:1578

RHSA-2021_1578

RHSA-2022:0063

RHSA-2022:0065

RHSA-2022:0072

RHSA-2022:0078

RHSA-2022_0063

RHSA-2022_0065

SUSE-SU-2021:1238-1

SUSE-SU-2021:14724-1

SUSE-SU-2021:1572-1

SUSE-SU-2021:1573-1

SUSE-SU-2021:1595-1

SUSE-SU-2021:1596-1

SUSE-SU-2021:1605-1

SUSE-SU-2021:1617-1

SUSE-SU-2021:1623-1

SUSE-SU-2021:1624-1

SUSE-SU-2021:1715-1

SUSE-SU-2021:1724-1

SUSE-SU-2021:1728-1

SUSE-SU-2021:1733-1

SUSE-SU-2021:1865-1

SUSE-SU-2021:1870-1

SUSE-SU-2021:1975-1

SUSE-SU-2021:1977-1

SUSE-SU-2021:2198-1

SUSE-SU-2021:2577-1

SUSE-SU-2021_14724-1

SUSE-SU-2021_1715-1

SUSE-SU-2021_1724-1

SUSE-SU-2021_1865-1

SUSE-SU-2021_1870-1

USN-5136-1

USN-5343-1

Produtos afetados

Alt Linux

Almalinux

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

Referências · 685

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_cgroup_escape.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_xtables_heap_oob_write_priv_esc.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/vmwgfx_fd_priv_esc.rb · Exploit
• 🔥 https://github.com/Bonfee/CVE-2022-25636 · Exploit
• 🔥 https://github.com/chompie1337/Linux_LPE_eBPF_CVE-2021-3490 · Exploit
• 🔥 https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19037 · Exploit
• 🔥 https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19039 · Exploit
• 🔥 https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19449 · Exploit
• 🔥 https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19036 · Exploit
• 🔥 https://github.com/tr3ee/CVE-2021-4204 · Exploit
• 🔥 https://github.com/PaloAltoNetworks/can-ctr-escape-cve-2022-0492 · Exploit
• 🔥 https://github.com/cgwalters/cve-2020-14386 · Exploit
• 🔥 https://github.com/veritas501/CVE-2021-22555-PipeVersion · Exploit
• 🔥 https://github.com/chenaotian/CVE-2022-0492 · Exploit