SB2021020340 - Red Hat Enterprise Linux 7 update for kernel-rt 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021020340

SB2021020340 - Red Hat Enterprise Linux 7 update for kernel-rt

Published: February 3, 2021

Security Bulletin ID SB2021020340
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2020-15436)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in fs/block_dev.c in the Linux kernel. A local user can run a specially crafted program to escalate privileges on the system.


2) Improper Privilege Management (CVE-ID: CVE-2020-35513)

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to improper privilege management in the Linux kernel NFS (network file system) functionality in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A local user can trigger the vulnerability to starve the resources and perform a denial of service attack.


Remediation

Install update from vendor's website.

References