CVE-2020-27815
A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.79%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.79% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-787
- Affected
- linux/linux kernel · debian/debian linux · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h300e firmware · netapp/h500e firmware · netapp/h700e firmware · netapp/h410s firmware · netapp/h410c firmware · netapp/aff a250 firmware · netapp/fas500f firmware
- Source
- secalert@redhat.com
References
- http://www.openwall.com/lists/oss-security/2020/11/30/5Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/12/28/1Exploit, Mailing List, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1897668%2CIssue Tracking
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c61b3e4839007668360ed8b87d7da96d2e59fc6cPatch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00018.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210702-0004/Third Party Advisory
- https://www.debian.org/security/2021/dsa-4843Third Party Advisory
- https://www.openwall.com/lists/oss-security/2020/11/30/5%2CMailing List
- https://www.openwall.com/lists/oss-security/2020/12/28/1%2CMailing List
- http://www.openwall.com/lists/oss-security/2020/11/30/5Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/12/28/1Exploit, Mailing List, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1897668%2CIssue Tracking
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c61b3e4839007668360ed8b87d7da96d2e59fc6cPatch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00018.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210702-0004/Third Party Advisory
- https://www.debian.org/security/2021/dsa-4843Third Party Advisory
- https://www.openwall.com/lists/oss-security/2020/11/30/5%2CMailing List
- https://www.openwall.com/lists/oss-security/2020/12/28/1%2CMailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.