PT-2020-5391 · Linux+6 · Linux Kernel+6
Adam Zabrocki
+1
·
Published
2020-04-01
·
Updated
2021-07-15
·
CVE-2020-12826
CVSS v3.1
5.3
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.6.5
Description
A signal access-control issue was discovered in the Linux kernel. The issue is caused by an integer overflow in the
exec id variable in include/linux/sched.h, which can interfere with a protection mechanism. This allows a child process to send an arbitrary signal to a parent process in a different security domain. The exploitation of this issue is limited by the time it takes for an integer overflow to occur and the lack of scenarios where signals to a parent process pose a significant threat.Recommendations
For Linux kernel versions prior to 5.6.5, update to version 5.6.5 or later to resolve the issue. As a temporary workaround, consider restricting signal handling between parent and child processes to minimize the risk of exploitation.
Exploit
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Linux Kernel
Red Hat
Ubuntu