PT-2020-6009 · Linux+6 · Linux Kernel+6

Published 2020-08-02 · Updated 2021-05-28 · CVE-2020-27152

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.9.2

Description The issue is related to an infinite loop caused by improper interaction between a resampler and edge triggering in the ioapic lazy update eoi function. This could allow an attacker to cause a denial of service.

Recommendations For versions prior to 5.9.2, update to version 5.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the ioapic lazy update eoi function until a patch is available.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALSA-2021:1093

ALT-PU-2020-3182

ALT-PU-2020-3211

ALT-PU-2020-3553

ALT-PU-2020-3570

ALT-PU-2021-1083

ALT-PU-2021-1105

ALT-PU-2021-1621

ALT-PU-2021-1656

ALT-PU-2021-1739

ALT-PU-2021-1862

ALT-PU-2021-1866

ALT-PU-2021-1870

BDU:2021-02588

CESA-2021_1081

CESA-2021_1093

CVE-2020-27152

MGASA-2021-0030

MGASA-2021-0031

RHSA-2021:1081

RHSA-2021:1093

RHSA-2021_1081

RHSA-2021_1093

USN-4659-1

USN-4752-1

Affected Products

Alt Linux

Almalinux

Centos

Linuxmint

Linux Kernel

Red Hat

Ubuntu

References · 70

• 🔥 https://bugzilla.kernel.org/show_bug.cgi?id=208767 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-27152 · Security Note
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9.2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4752-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0031.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-27152 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15436 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4659-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25643 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24490 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-27152 · Security Note
• https://ubuntu.com/security/CVE-2020-29661 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28915 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27152 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29660 · Vendor Advisory