CVE-2020-10751
Published: 26 May 2020
A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.
From the Ubuntu Security Team
Dmitry Vyukov discovered that the SELinux netlink security hook in the Linux kernel did not validate messages in some situations. A privileged attacker could use this to bypass SELinux netlink restrictions.
Notes
| Author | Note |
|---|---|
| sbeattie | SELinux specific, not the default LSM in Ubuntu. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
linux Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-106.107)
|
| eoan |
Released
(5.3.0-62.56)
|
|
| focal |
Released
(5.4.0-37.41)
|
|
| trusty |
Ignored
(was needs-triage ESM criteria)
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Released
(4.4.0-184.214)
|
|
|
Patches: Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
|
linux-aws Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1073.77)
|
| eoan |
Released
(5.3.0-1030.32)
|
|
| focal |
Released
(5.4.0-1015.15)
|
|
| trusty |
Released
(4.4.0-1073.77)
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Released
(4.4.0-1109.120)
|
|
|
linux-aws-5.0 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(was needs-triage now end-of-life)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-aws-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1030.32~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-aws-5.4 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1018.18~18.04.1)
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-aws-hwe Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Released
(4.15.0-1073.77~16.04.1)
|
|
|
linux-azure Launchpad, Ubuntu, Debian |
bionic |
Ignored
(was needs-triage now end-of-life)
|
| eoan |
Released
(5.3.0-1032.33)
|
|
| focal |
Released
(5.4.0-1016.16)
|
|
| trusty |
Released
(4.15.0-1089.99~14.04.1)
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Released
(4.15.0-1089.99~16.04.1)
|
|
|
linux-azure-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1089.99)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-azure-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1032.33~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-azure-5.4 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1020.20~18.04.1)
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-azure-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(was needs-triage now end-of-life)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-gcp Launchpad, Ubuntu, Debian |
bionic |
Ignored
(was needs-triage now end-of-life)
|
| eoan |
Released
(5.3.0-1030.32)
|
|
| focal |
Released
(5.4.0-1015.15)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Released
(4.15.0-1077.87~16.04.1)
|
|
|
linux-gcp-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1077.87)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-gcp-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1030.32~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-gcp-5.4 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1019.19~18.04.2)
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-gcp-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(was needs-triage now end-of-life)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-gke-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1063.66)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-gke-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1043.44)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-gke-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1030.32~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-hwe Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-62.56~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Released
(4.15.0-106.107~16.04.1)
|
|
|
linux-hwe-5.4 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-37.41~18.04.1)
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-hwe-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(was needs-triage now end-of-life)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Ignored
(was needs-triage now end-of-life)
|
|
|
linux-kvm Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1067.68)
|
| eoan |
Released
(5.3.0-1024.26)
|
|
| focal |
Released
(5.4.0-1015.15)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Released
(4.4.0-1075.82)
|
|
|
linux-lts-trusty Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-lts-xenial Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Released
(4.4.0-184.214~14.04.1)
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-oem Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1087.97)
|
| eoan |
Ignored
(reached end-of-life)
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Ignored
(was needs-triage now end-of-life)
|
|
|
linux-oem-5.6 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| eoan |
Does not exist
|
|
| focal |
Released
(5.6.0-1011.11)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-oem-osp1 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1063.68)
|
| eoan |
Ignored
(reached end-of-life)
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-oracle Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1045.49)
|
| eoan |
Released
(5.3.0-1028.30)
|
|
| focal |
Released
(5.4.0-1015.15)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Released
(4.15.0-1045.49~16.04.1)
|
|
|
linux-oracle-5.0 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(was needs-triage now end-of-life)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-oracle-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1028.30~18.04.1)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-oracle-5.4 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1019.19~18.04.1)
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-raspi Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| eoan |
Does not exist
|
|
| focal |
Released
(5.4.0-1012.12)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-raspi-5.4 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.4.0-1013.13~18.04.1)
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-raspi2 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1063.67)
|
| eoan |
Released
(5.3.0-1028.30)
|
|
| focal |
Ignored
(was needs-triage now end-of-life)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Released
(4.4.0-1134.143)
|
|
|
linux-raspi2-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1028.30~18.04.2)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-riscv Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| eoan |
Does not exist
|
|
| focal |
Released
(5.4.0-27.31)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Does not exist
|
|
|
linux-snapdragon Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1080.87)
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.7~rc4)
|
|
| xenial |
Released
(4.4.0-1138.146)
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.1 |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10751
- https://git.kernel.org/linus/fb73974172ffaaf57a7c42f35424d9aece1a5af6
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10751
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fb73974172ffaaf57a7c42f35424d9aece1a5af6
- https://lore.kernel.org/selinux/CACT4Y+b8HiV6KFuAPysZD=5hmyO4QisgxCKi4DHU3CfMPSP=yg@mail.gmail.com/
- https://www.openwall.com/lists/oss-security/2020/04/30/5
- https://ubuntu.com/security/notices/USN-4391-1
- https://ubuntu.com/security/notices/USN-4389-1
- https://ubuntu.com/security/notices/USN-4390-1
- https://ubuntu.com/security/notices/USN-4412-1
- https://ubuntu.com/security/notices/USN-4413-1
- NVD
- Launchpad
- Debian