CVE-2020-10027
published 2020-05-11CVE-2020-10027: An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.69%
48.0th percentile
An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zephyrproject-rtos | zephyr | >= 1.14.0 < unspecified | unspecified |
| zephyrproject-rtos | zephyr | >= 2.1.0 < unspecified | unspecified |
| zephyrproject | zephyr | — | — |
| zephyrproject | zephyr | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Wiz
5 reasons endpoint security agents are not enough | Wiz Blog
blogs_wiz·2022-02-03
5 reasons endpoint security agents are not enough | Wiz Blog
Agents have always been an inherent part of security and operations, finding a place in vulnerability scanning, threat detection, data loss prevention (DLP), remote management, virtual private networks (VPN), and more. We all know them, we all have them, and as a result, we are all faced with the burden of managing, deploying, and updating countless endpoint agents. In the cloud, this becomes even more complex since IT teams do not necessarily have control over all the deployed workloads, leading to an endless cat-and-mouse game of trying to get developers to deploy the various agents.
In this post, we discuss five security limitations of endpoint security agents: lack of coverage, deployment difficulties, an increased attack surface, susceptible high privileges, and ease of avoidance by
arXiv
SoK: Where's the "up"?! A Comprehensive (bottom-up) Study on the Security of Arm Cortex-M Systems
arxiv_fulltext·2024-05-13
SoK: Where's the "up"?! A Comprehensive (bottom-up) Study on the Security of Arm Cortex-M Systems
[1]
hlcolorRGB20, 255, 20hlcolor
blackZiming: #1
[1]
hlcolorRGB20, 255, 20hlcolor
blackJun: #1
[1]
hlcolorRGB20, 255, 20hlcolor
blackLe: #1
[1]
hlcolorRGB255, 241, 158hlcolor
blackZheyuan: #1
[1]
hlcolorRGB255, 20, 20hlcolor
blackZQ: #1
[1]
hlcolorRGB0,32,96hlcolor
whiteXi: #1
arch
[1]
arch
#1A [2]arch. #1
bug
[1]
bug
#1B [2]bug. #1
limitation
[1]
limitation
4pt #1L [2]limitation. #1
issue
[1]
issue
4pt #1I [2]issue. #1
defense
[1]
defense
4pt #1D [2]defense. #1
test
[1]
test
T [2]-test. #1
recommendation
[1]
recommendation
4pt #1R [2]recommendation. #1
plain
[2]tabular@#1@#2tabular
* [1]
* [1] [baseline=(char.base)]
[shape=circle,draw,inner sep=2pt] (char) #1;
* [1] [baseline=(char.base)]
[shape=circle,draw,inner sep=1pt] (char) #1;
.5em
[1]picture(1,1)
0=#1 (.
https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10027https://github.com/zephyrproject-rtos/zephyr/pull/23328https://github.com/zephyrproject-rtos/zephyr/pull/23499https://github.com/zephyrproject-rtos/zephyr/pull/23500https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-35https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10027https://github.com/zephyrproject-rtos/zephyr/pull/23328https://github.com/zephyrproject-rtos/zephyr/pull/23499https://github.com/zephyrproject-rtos/zephyr/pull/23500https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-35
2020-05-11
Published