CVE-2020-15852

HIGH

Linux Kernel < 5.7.9 - Incorrect Default Permissions

Title source: rule
STIX 2.1

Description

An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tss_invalidate_io_bitmap mishandling causes a loss of synchronization between the I/O bitmaps of TSS and Xen, aka CID-cadfad870154.

References (5)

Core 5
Core References
Patch, Third Party Advisory x_refsource_misc
http://xenbits.xen.org/xsa/advisory-329.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2020/07/21/2
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20200810-0001/

Scores

CVSS v3 7.8
EPSS 0.0016
EPSS Percentile 36.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-276
Status published
Products (5)
linux/linux_kernel 5.5 - 5.7.9
netapp/cloud_backup
netapp/solidfire_baseboard_management_controller
netapp/steelstore_cloud_integrated_storage
xen/xen < 4.13.1
Published Jul 20, 2020
Tracked Since Feb 18, 2026