CVE-2020-35508: linux linux_kernel Improper Initialization
CVSS: 4.5v3.1MediumModified
AliasesUBUNTU-CVE-2020-35508DEBIAN-CVE-2020-35508
Published 26-03-2021Last modified 04-08-2024
Vulnerability summary
CVE-2020-35508 is a medium (CVSS 4.5) Improper Initialization vulnerability in linux linux_kernel. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.2% of scored vulnerabilities.
CVSS score
4.5/10
010
Medium · v3.1 (NVD)EPSS score
0.22%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 2Timeline
- 26-03-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 4.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Medium 4.4Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
0.00 pp
From 0.22% on 18-09-2026
18-09-202618-10-2026
EPSS score0.22%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected systems
Ubuntu45 products
- linuxAll versions (No fix recorded) | < 4.4.0-198.230 | < 4.15.0-129.132 | < 5.4.0-59.65
- linux-aws< 4.4.0-1083.87 | < 4.4.0-1119.133 | < 4.15.0-1091.96 | < 5.4.0-1034.35
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-5.4< 5.4.0-1034.35~18.04.1
Netapp16 products
- a700s_firmwarena
- aff_a400_firmwarena
- brocade_fabric_operating_systemna
- fas8300_firmwarena
- fas8700_firmwarena
Debian1 product
- linux< 5.9.9-1
Linux1 product
- linux_kernelEOL< 5.12 | 5.12 | 5.12:rc1 | 5.12:rc2 | 5.12:rc3 | 5.12:rc4
Redhat1 product
5 vendors · 64 products
References
11 links- bugzilla.redhat.com/show_bug.cgi?id=1902724X Refsource MISCREPORTIssue TrackingPatchThird Party Advisory
- github.com/torvalds/linux/commit/b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948X Refsource MISCREPORTPatchThird Party Advisory
