CVE-2020-15852: linux linux_kernel Incorrect Default Permissions
Vulnerability summary
CVE-2020-15852 is a high (CVSS 7.8) Incorrect Default Permissions vulnerability in linux linux_kernel. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 20-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tss_invalidate_io_bitmap mishandling causes a loss of synchronization between the I/O bitmaps of TSS and Xen, aka CID-cadfad870154.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu14 products
- linuxAll versions (No fix recorded)
- linux-awsAll versions (No fix recorded)
- linux-aws-5.0All versions (No fix recorded)
- linux-azureAll versions (No fix recorded)
- linux-azure-edgeAll versions (No fix recorded)
Netapp3 products
Debian1 product
- linux< 5.7.10-1
Linux1 product
- linux_kernel≥ 5.5, ≤ 5.7.9
Xen1 product
- xen≤ 4.13.1
5 vendors · 20 products
References
9 links- github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2X Refsource MISCREPORTPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2020/07/21/2Mailing ListX Refsource MLISTREPORTThird Party Advisory
