Denial of service in Linux kernel

1) Use-after-free

EUVDB-ID: #VU46586

Risk: Low

CVSSv3.1: 3.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10720

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with local access to crash the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.0 - 5.1.21

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:5.0.21:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.1.21:*:*:*:*:*:*:*

External links

http://bugzilla.redhat.com/show_bug.cgi?id=1781204
http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4270d6795b0580287453ea55974d948393e66ef

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.