CVE-2020-27825

moderate-risk

Published 2020-12-11

A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat.

Do I need to act?

0.14% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.7/10 Medium

LOCAL / HIGH complexity

Affected Products (9)

Linux Kernel

Enterprise Linux

Enterprise Mrg

Debian Linux

Cloud Backup

Solidfire Baseboard Management Controller Firmware

H410C Firmware

Affected Vendors

Debian Redhat Linux Netapp

References (10)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1905155

Mailing List https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html

Third Party Advisory https://security.netapp.com/advisory/ntap-20210521-0008/

Third Party Advisory https://www.debian.org/security/2021/dsa-4843

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1905155

Mailing List https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html

Third Party Advisory https://security.netapp.com/advisory/ntap-20210521-0008/

Third Party Advisory https://www.debian.org/security/2021/dsa-4843

/ 100

moderate-risk

Severity 15/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 15/34 · Moderate