First published: Mon Jun 01 2020(Updated: )
A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/kernel-rt | <0:3.10.0-1127.18.2.rt56.1116.el7 | 0:3.10.0-1127.18.2.rt56.1116.el7 |
redhat/kernel | <0:3.10.0-1127.18.2.el7 | 0:3.10.0-1127.18.2.el7 |
redhat/kernel | <0:3.10.0-957.58.2.el7 | 0:3.10.0-957.58.2.el7 |
redhat/kernel | <0:3.10.0-1062.33.1.el7 | 0:3.10.0-1062.33.1.el7 |
redhat/kernel-rt | <0:4.18.0-193.13.2.rt13.65.el8_2 | 0:4.18.0-193.13.2.rt13.65.el8_2 |
redhat/kernel | <0:4.18.0-193.13.2.el8_2 | 0:4.18.0-193.13.2.el8_2 |
redhat/kernel | <0:4.18.0-80.27.1.el8_0 | 0:4.18.0-80.27.1.el8_0 |
redhat/kernel | <0:4.18.0-147.24.2.el8_1 | 0:4.18.0-147.24.2.el8_1 |
Linux Kernel | >=4.5<4.9.227 | |
Linux Kernel | >=4.10<4.14.184 | |
Linux Kernel | >=4.15<4.19.127 | |
Linux Kernel | >=4.20<5.4.45 | |
Linux Kernel | >=5.5<5.6.17 | |
Linux Kernel | >=5.7<5.7.1 | |
openSUSE | =15.1 | |
Red Hat Enterprise Linux | =7.0 | |
Red Hat Enterprise Linux | =8.0 | |
Red Hat Enterprise MRG | =2.0 | |
Fedoraproject Fedora | =31 | |
Debian GNU/Linux | =8.0 | |
Ubuntu Linux | =16.04 | |
Ubuntu Linux | =18.04 | |
Ubuntu Linux | =20.04 | |
NetApp Active IQ Unified Manager for VMware vSphere | ||
netapp cloud backup | ||
NetApp SteelStore | ||
Linux Kernel | >=4.5.1<=5.6.16 | |
Linux Kernel | =4.5-rc2 | |
Linux Kernel | =4.5-rc3 | |
Linux Kernel | =4.5-rc4 | |
Linux Kernel | =4.5-rc5 | |
Linux Kernel | =4.5-rc6 | |
Linux Kernel | =4.5-rc7 | |
debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.128-1 6.12.12-1 6.12.13-1 |
Do not use DAX enabled storage.
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
CVE-2020-10757 has been classified with a medium severity level due to its potential for privilege escalation.
To fix CVE-2020-10757, update your Linux Kernel to versions 3.10.0-1127.18.2.el7 or later, or follow your distribution's recommendations for patches.
CVE-2020-10757 affects versions of the Linux Kernel after 4.5-rc1, particularly systems using DAX enabled storage.
CVE-2020-10757 is a privilege escalation vulnerability related to how the Linux Kernel handles DAX Huge Pages.
The impact of CVE-2020-10757 allows a local attacker to escalate their privileges on the system if they have access to vulnerable DAX enabled storage.