Incorrect Permission Assignment for Critical Resource Affecting kernel-uek-debug-devel package, versions <0:5.4.17-2011.6.2.el8uek


Severity

Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE8-KERNELUEKDEBUGDEVEL-2578836
  • published10 Apr 2022
  • disclosed16 Sept 2020

Introduced: 16 Sep 2020

CVE-2020-10781  (opens in a new tab)
CWE-732  (opens in a new tab)

How to fix?

Upgrade Oracle:8 kernel-uek-debug-devel to version 0:5.4.17-2011.6.2.el8uek or higher.
This issue was patched in ELSA-2020-5848.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-debug-devel package and not the kernel-uek-debug-devel package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.

CVSS Scores

version 3.1