Lucene search

[email protected]CVE-2020-10766

HistorySep 15, 2020 - 11:15 p.m.

CVE-2020-10766

2020-09-1523:15:12

CWE-440

[email protected]

web.nvd.nist.gov

215

In Wild

cve

2020

10766

linux kernel

ssbd

local attacker

vulnerability

confidentiality

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.9

Confidence

High

EPSS

Percentile

5.1%

JSON

A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.

Affected configurations

Vulners

NVD

Node

linuxlinux_kernelRange≤5.8

VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	*	cpe:2.3:o:linux:linux_kernel::::::::

CNA Affected

[
  {
    "product": "kernel",
    "vendor": "Linux Kernel",
    "versions": [
      {
        "status": "affected",
        "version": "before 5.8-rc1"
      }
    ]
  }
]