CVE-2020-10027: ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers
An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-10027?
CVE-2020-10027 is considered a high-severity vulnerability allowing privilege escalation from user thread execution to kernel level.
How do I fix CVE-2020-10027?
To mitigate CVE-2020-10027, upgrade to Zephyr versions later than 1.14.0 and 2.1.0 that include the necessary patches.
Which versions of Zephyr are affected by CVE-2020-10027?
CVE-2020-10027 affects Zephyr versions 1.14.0 and later, as well as 2.1.0 and later versions.
Can CVE-2020-10027 be exploited remotely?
CVE-2020-10027 requires an attacker to have code execution within a user thread, making a remote exploit challenging.
What types of systems are vulnerable to CVE-2020-10027?
Systems running affected versions of the Zephyr Project RTOS are vulnerable to CVE-2020-10027.