SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2020-35508

A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers.

MEDIUM 4.5EPSS 0.22%

Does this matter?

Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.

Description

A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.

CVSS 3.1
4.5 MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS
0.22% probability · 13th percentile
CISA KEV
Not listed
Weakness
CWE-665, CWE-362
Affected
linux/linux kernel · redhat/enterprise linux · netapp/a700s firmware · netapp/brocade fabric operating system firmware · netapp/fas8300 firmware · netapp/fas8700 firmware · netapp/aff a400 firmware · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h300e firmware · netapp/h500e firmware · netapp/h700e firmware · netapp/h410s firmware · netapp/h410c firmware · netapp/h610c firmware · netapp/h610s firmware · netapp/h615c firmware
Source
secalert@redhat.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.