CVE-2020-35508 Race condition in kernel
A local attacker can exploit a race condition in Linux kernel signal handling to bypass security checks and send signals to privileged processes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35508?
CVE-2020-35508 is a medium-severity vulnerability in Linux kernel, published on 26 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.
Which versions are affected by CVE-2020-35508?
It affects 18 products.
Products include Linux kernel, Netapp A700s Firmware, Netapp Aff A400 Firmware, Netapp Brocade Fabric Operating System Firmware, Netapp Fas8300 Firmware, Netapp Fas8700 Firmware and 12 more.
How do I fix CVE-2020-35508?
Apply the vendor's patch.
Is CVE-2020-35508 being exploited?
There is no known exploitation of CVE-2020-35508 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-6528, DEBIAN-CVE-2020-35508, GHSA-467m-6jmp-65g9, UBUNTU-CVE-2020-35508.