PT-2020-6080 · Linux+7 · Linux Kernel+7

Eddy Wu + 1 · Published 2020-11-08 · Updated 2023-05-17 · CVE-2020-35508

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw was found in the Linux kernel's child/parent process identification handling while filtering signal handlers, related to a race condition and incorrect initialization of the process id. This issue can be exploited by a local attacker to bypass checks and send any signal to a privileged process, potentially allowing privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Race Condition

Improper Initialization

Weakness Enumeration

CWE-367

CWE-362

CWE-665

Related Identifiers

ALSA-2021:1578

ALT-PU-2021-1833

ALT-PU-2021-1888

ALT-PU-2021-1896

ALT-PU-2021-1983

ALT-PU-2021-3481

ALT-PU-2022-1240

ALT-PU-2022-1419

ALT-PU-2022-1421

ALT-PU-2023-1814

AZL-6528

BDU:2021-02938

CESA-2021_1578

CESA-2021_1739

CVE-2020-35508

RHSA-2021:1578

RHSA-2021:1739

RHSA-2021:2718

RHSA-2021:2719

RHSA-2021_1578

RHSA-2021_1739

USN-4751-1

USN-4752-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Linux Kernel

Red Hat

Ubuntu

References · 93

• https://github.com/torvalds/linux/commit/b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 · Patch
• https://ubuntu.com/security/CVE-2020-27835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35508 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1902724 · Patch
• https://ubuntu.com/security/CVE-2020-24490 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35508 · Security Note
• https://ubuntu.com/security/CVE-2020-29661 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28588 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29660 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28974 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35508 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27777 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25656 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25212 · Vendor Advisory