CVE-2020-27777: linux linux_kernel Missing Authorization

Modified

AliasesUBUNTU-CVE-2020-27777DEBIAN-CVE-2020-27777

Published 15-12-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-27777 is a high (CVSS 7.2) Missing Authorization vulnerability in linux linux_kernel. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 41.2% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Routine

Not severe (CVSS 6.7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.2/10

010

High · v2.0 (NVD)

EPSS score

0.48%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference

Timeline

15-12-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.16.7v2.07.2

EPSS trend

Probability

0.48%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.48% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (git.kernel.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected systems

Version check

Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu20 products

linuxAll versions (No fix recorded) | < 4.4.0-201.233 | < 4.15.0-129.132 | < 5.4.0-59.65
linux-aws-fips< 4.15.0-2034.35 | All versions (No fix recorded) | < 5.4.0-1069.73+fips2
linux-azure-fdeAll versions (No fix recorded)
linux-azure-fde-5.15< 5.15.0-1114.123~20.04.1
linux-azure-fips< 4.15.0-2016.18 | All versions (No fix recorded) | < 5.4.0-1073.76+fips1