CVE-2020-27815

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-27815
A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.1 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:C

Exploitability : 3.9 / Impact : 8.5

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact COMPLETE

References
Link Resource
http://www.openwall.com/lists/oss-security/2020/11/30/5 Exploit Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/12/28/1 Exploit Mailing List Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1897668%2C Issue Tracking
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c61b3e4839007668360ed8b87d7da96d2e59fc6c Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20210702-0004/ Third Party Advisory
https://www.debian.org/security/2021/dsa-4843 Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/11/30/5%2C Mailing List
https://www.openwall.com/lists/oss-security/2020/12/28/1%2C Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:netapp:fas500f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:fas500f:-:*:*:*:*:*:*:*
History

28 Jul 2023, 19:32

Type Values Removed Values Added
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1897668%2C - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1897668%2C - Issue Tracking
References (MISC) https://www.openwall.com/lists/oss-security/2020/11/30/5%2C - (MISC) https://www.openwall.com/lists/oss-security/2020/11/30/5%2C - Mailing List
References (MISC) https://www.openwall.com/lists/oss-security/2020/12/28/1%2C - (MISC) https://www.openwall.com/lists/oss-security/2020/12/28/1%2C - Mailing List
CPE cpe:2.3:o:linux:linux_kernel:5.9.6:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

12 Feb 2023, 23:40

Type Values Removed Values Added
References
  • {'url': 'https://www.openwall.com/lists/oss-security/2020/12/28/1,', 'name': 'https://www.openwall.com/lists/oss-security/2020/12/28/1,', 'tags': ['Exploit', 'Mailing List', 'Patch', 'Third Party Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1897668,', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1897668,', 'tags': ['Broken Link', 'Issue Tracking'], 'refsource': 'MISC'}
  • {'url': 'https://www.openwall.com/lists/oss-security/2020/11/30/5,', 'name': 'https://www.openwall.com/lists/oss-security/2020/11/30/5,', 'tags': ['Exploit', 'Mailing List', 'Third Party Advisory'], 'refsource': 'MISC'}
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1897668%2C -
  • (MISC) https://www.openwall.com/lists/oss-security/2020/11/30/5%2C -
  • (MISC) https://www.openwall.com/lists/oss-security/2020/12/28/1%2C -
CWE CWE-787

10 Dec 2021, 19:56

Type Values Removed Values Added
CWE CWE-787
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20210702-0004/ - Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1897668, - Broken Link (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1897668, - Broken Link, Issue Tracking
CPE cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:fas500f:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:fas500f_firmware:-:*:*:*:*:*:*:*

03 Jun 2021, 14:29

Type Values Removed Values Added
References (DEBIAN) https://www.debian.org/security/2021/dsa-4843 - (DEBIAN) https://www.debian.org/security/2021/dsa-4843 - Third Party Advisory
References (MISC) https://www.openwall.com/lists/oss-security/2020/11/30/5, - (MISC) https://www.openwall.com/lists/oss-security/2020/11/30/5, - Exploit, Mailing List, Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1897668, - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1897668, - Broken Link
References (MLIST) http://www.openwall.com/lists/oss-security/2020/11/30/5 - (MLIST) http://www.openwall.com/lists/oss-security/2020/11/30/5 - Exploit, Mailing List, Third Party Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html - (MLIST) https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html - Mailing List, Third Party Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html - (MLIST) https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html - Mailing List, Third Party Advisory
References (MISC) https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c61b3e4839007668360ed8b87d7da96d2e59fc6c - (MISC) https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c61b3e4839007668360ed8b87d7da96d2e59fc6c - Patch, Vendor Advisory
References (MLIST) http://www.openwall.com/lists/oss-security/2020/12/28/1 - (MLIST) http://www.openwall.com/lists/oss-security/2020/12/28/1 - Exploit, Mailing List, Patch, Third Party Advisory
References (MISC) https://www.openwall.com/lists/oss-security/2020/12/28/1, - (MISC) https://www.openwall.com/lists/oss-security/2020/12/28/1, - Exploit, Mailing List, Patch, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : 6.1
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:5.9.6:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

26 May 2021, 13:33

Type Values Removed Values Added
CWE CWE-119

26 May 2021, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-05-26 13:15

Updated : 2023-12-10 13:55

NVD link : CVE-2020-27815

Mitre link : CVE-2020-27815

CVE.ORG link : CVE-2020-27815

JSON object : View

Products Affected

netapp

  • h700e
  • h700s_firmware
  • h500s_firmware
  • h700s
  • h410c_firmware
  • h700e_firmware
  • h300e_firmware
  • h300s_firmware
  • aff_a250
  • h500e_firmware
  • fas500f_firmware
  • h500s
  • h410c
  • h410s_firmware
  • h300e
  • h410s
  • h300s
  • aff_a250_firmware
  • fas500f
  • h500e

linux

  • linux_kernel

debian

  • debian_linux
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-787

Out-of-bounds Write