CVE-2020-27815

moderate-risk

Published 2021-05-26

A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Do I need to act?

0.20% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (13)

Linux Kernel

Debian Linux

H300S Firmware

H500S Firmware

H700S Firmware

H300E Firmware

H500E Firmware

H700E Firmware

H410S Firmware

H410C Firmware

Aff A250 Firmware

Fas500F Firmware

Affected Vendors

Debian Linux Netapp

References (20)

Exploit http://www.openwall.com/lists/oss-security/2020/11/30/5

Exploit http://www.openwall.com/lists/oss-security/2020/12/28/1

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1897668%2C

Patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c6...

Mailing List https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html

Third Party Advisory https://security.netapp.com/advisory/ntap-20210702-0004/

Third Party Advisory https://www.debian.org/security/2021/dsa-4843

Mailing List https://www.openwall.com/lists/oss-security/2020/11/30/5%2C

Mailing List https://www.openwall.com/lists/oss-security/2020/12/28/1%2C