CVE-2020-15852 Privilege escalation in n/a
An attacker can gain unauthorized I/O port permissions due to synchronization errors in the Linux kernel's TSS handling, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15852?
CVE-2020-15852 is a high-severity vulnerability in Linux kernel, published on 20 Jul 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tss_invalidate_io_bitmap mishandling causes a loss of synchronization between the I/O bitmaps of TSS and Xen, aka CID-cadfad870154.
Weakness: CWE-276
Which versions are affected by CVE-2020-15852?
It affects 5 products.
Products include Linux kernel, Netapp Cloud Backup, Netapp Solidfire Baseboard Management Controller, Netapp Steelstore Cloud Integrated Storage, Xen Xen.
How do I fix CVE-2020-15852?
Apply the vendor's patch.
Is CVE-2020-15852 being exploited?
There is no known exploitation of CVE-2020-15852 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2020-15852, GHSA-c6v6-mvg4-h5hx, UBUNTU-CVE-2020-15852.