CVE-2020-10024: ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers
The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-10024?
CVE-2020-10024 is considered to have a high severity due to its potential for privilege escalation.
How do I fix CVE-2020-10024?
To fix CVE-2020-10024, upgrade to Zephyr versions 1.14.3 or 2.1.1 or later where the vulnerability has been patched.
Which versions of Zephyr are affected by CVE-2020-10024?
CVE-2020-10024 affects Zephyr versions 1.14.2 and 2.1.0.
What type of vulnerability is CVE-2020-10024?
CVE-2020-10024 is a privilege escalation vulnerability due to improper validation of system call numbers in the arm platform-specific code.
Can an attacker exploit CVE-2020-10024 remotely?
Exploitation of CVE-2020-10024 requires an attacker to have obtained code execution within a user thread, so it is not a remote vulnerability.