CVE-2020-10751Acceptance of Extraneous Untrusted Data With Trusted Data in Selinux

Severity
6.1MEDIUMNVD
EPSS
0.1%
top 75.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMay 26
Latest updateMay 24

Description

A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:NExploitability: 1.8 | Impact: 4.2

Affected Packages4 packages

NVDkernel/selinux< 5.7
CVEListV5the_linux_foundation/kernelbefore 5.7
Debianlinux/linux_kernel< 5.6.14-1+3

Patches

🔴Vulnerability Details

3
GHSA
GHSA-4gwr-f7fq-56wc: A flaw was found in the Linux kernels SELinux LSM hook implementation before version 52022-05-24
OSV
CVE-2020-10751: A flaw was found in the Linux kernels SELinux LSM hook implementation before version 52020-05-26
CVEList
CVE-2020-10751: A flaw was found in the Linux kernels SELinux LSM hook implementation before version 52020-05-26

📋Vendor Advisories

7
Android
CVE-2020-10751: SELinux2020-08-01
Ubuntu
Linux kernel vulnerabilities2020-07-06
Ubuntu
Linux kernel vulnerabilities2020-06-11
Ubuntu
Linux kernel vulnerabilities2020-06-11
Ubuntu
Linux kernel vulnerabilities2020-06-10

💬Community

2
Bugzilla
CVE-2020-10751 kernel: SELinux netlink permission check bypass [fedora-all]2020-06-05
Bugzilla
CVE-2020-10751 kernel: SELinux netlink permission check bypass2020-05-25
CVE-2020-10751 — Kernel Selinux vulnerability | cvebase