CVE-2020-15780
MediumAn issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.
CVSS 3.1 score
6.7
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness type
CWE-862CVE-2020-15780 is classified as CWE-862
See CWE-862 on MITRE CWE for full details on this weakness type.
References
The following references provide additional information about CVE-2020-15780 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Release Notes Vendor Advisory
-
Ubuntu Securityhttps://usn.ubuntu.com/4425-1/Third Party Advisory
-
Ubuntu Securityhttps://usn.ubuntu.com/4426-1/Third Party Advisory
-
Ubuntu Securityhttps://usn.ubuntu.com/4439-1/Third Party Advisory
-
Ubuntu Securityhttps://usn.ubuntu.com/4440-1/Third Party Advisory
-
Mailing List Third Party Advisory
-
PatchKernel patch commithttp://www.openwall.com/lists/oss-security/2020/07/20/7
-
PatchKernel patch commithttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=75b0cea7bf307f362057cc778efe89af4c615354
-
PatchKernel patch commithttps://git.zx2c4.com/american-unsigned-language/tree/american-unsigned-language-2.sh
Frequently asked questions
-
What is CVE-2020-15780?
CVE-2020-15780 is a Medium severity Linux kernel vulnerability with a CVSS score of 6.7 out of 10 . CVE-2020-15780 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
What is the CVSS score for CVE-2020-15780?
CVE-2020-15780 has a CVSS score of 6.7 out of 10, rated Medium severity (CVSS 3.1). The vector string is
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. -
Is there a patch available for CVE-2020-15780?
No patch is currently available for CVE-2020-15780. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
-
Is CVE-2020-15780 actively exploited?
No — CVE-2020-15780 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.