Vulnerability Description
A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kernel | Selinux | < 5.7 |
| Redhat | Enterprise Linux Server | 7.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html
- http://www.openwall.com/lists/oss-security/2020/05/27/3Mailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10751Issue TrackingPatchThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fbPatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
- https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html
- https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html
- https://lore.kernel.org/selinux/CACT4Y+b8HiV6KFuAPysZD=5hmyO4QisgxCKi4DHU3CfMPSP
- https://usn.ubuntu.com/4389-1/
- https://usn.ubuntu.com/4390-1/
- https://usn.ubuntu.com/4391-1/
- https://usn.ubuntu.com/4412-1/
- https://usn.ubuntu.com/4413-1/
- https://www.debian.org/security/2020/dsa-4698
FAQ
What is CVE-2020-10751?
CVE-2020-10751 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrect...
How severe is CVE-2020-10751?
CVE-2020-10751 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10751?
Check the references section above for vendor advisories and patch information. Affected products include: Kernel Selinux, Redhat Enterprise Linux Server.