CVE-2020-10768 Vulnerability Details

  /     /     /  

CVE-2020-10768 Metadata Quick Info

CVE Published: 15/09/2020 | CVE Updated: 04/08/2024 | CVE Year: 2020
Source: redhat | Vendor: Linux Kernel | Product: kernel
Status : PUBLISHED

---

CVE-2020-10768 Description

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being \'force disabled\' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.

Metrics

CVSS Version: 3.1 | Base Score: 5.5 MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* LOCAL
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* LOW
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* NONE
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-440
CWE Name: CWE-440
Source: Linux Kernel

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).