CVE-2020-25284

Advisory lineage Upstream: 0 Downstream: 27
Modified
Published: 13 Sept 2020, 17:28
Last modified:04 Aug 2024, 15:33

Vulnerability Summary

Overall Risk (default)
low
16/100
CVSS Score
4.1 MEDIUM
v3.1 (nvd)
EPSS Score
0.08% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

13 Sept 2020, 17:28
Published
Vulnerability first disclosed
04 Aug 2024, 15:33
Last Modified
Vulnerability information updated

Description

The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.1CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
  • v2.0•LOW•Score: 1.9AV:L/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.08%• Percentile: 23%

Techniques & Countermeasures

  • CWE-863•Incorrect Authorization

    The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

  • debian•debian_linux

    9.0

  • linux•linux_kernel

    < 5.8.9

  • opensuse•leap

    15.1

References (7)