CVE-2020-28588
- State
- Published
- Severity
- 4.0 Medium
- Published
- May 10, 2021
- Updated
- Aug 4, 2024
- Reserved
- Nov 13, 2020
Description
An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifically, this issue has been introduced in v5.1-rc4 (commit 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) and is still present in v5.10-rc4, so it’s likely that all versions in between are affected. An attacker can read /proc/pid/syscall to trigger this vulnerability, which leads to the kernel leaking memory contents.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 4.0 Medium | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | talos |
Weaknesses
- CWE-681 Incorrect Conversion between Numeric Types
Affected Products
| Product | Versions |
|---|---|
Linux Kerneln/a |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.