Strix
26.1K

CVE-2020-10711

MEDIUMCVSS 5.9/10EPSS 3.10%

Last modified

CVE-2020-10711 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. EPSS estimates a 3.10% chance of exploitation in the next 30 days.

Description

A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.

Metrics

CVSS 3.1
5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
3.10%

86.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
LinuxLinux Kernel< 5.7
Redhat3scale2.0
RedhatOpenstack13
RedhatVirtualization Host4.0
RedhatEnterprise Linux6.0
RedhatEnterprise Linux7.0
RedhatEnterprise Linux8.0
RedhatEnterprise Linux Aus7.4
RedhatEnterprise Linux Server Tus7.4
RedhatMessaging Realtime Grid2.0
DebianDebian Linux8.0
DebianDebian Linux9.0
DebianDebian Linux10.0
OpensuseLeap15.1
OpensuseLeap15.2
CanonicalUbuntu Linux14.04
CanonicalUbuntu Linux16.04
CanonicalUbuntu Linux18.04
CanonicalUbuntu Linux19.10
CanonicalUbuntu Linux20.04

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-10711?
A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.
How severe is CVE-2020-10711?
CVE-2020-10711 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 3.10% probability of exploitation in the next 30 days.
How do I fix CVE-2020-10711?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-10711?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST