Denial of Service (DoS) Affecting torvalds/linux package, versions [0,]


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.12% (33rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-TORVALDSLINUX-3006634
  • published26 Jan 2022
  • disclosed10 May 2021
  • creditUnknown

Introduced: 10 May 2021

CVE-2020-28588  (opens in a new tab)
CWE-681  (opens in a new tab)

How to fix?

There is no fixed version for torvalds/linux.

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS). An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifically, this issue has been introduced in v5.1-rc4 (commit 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) and is still present in v5.10-rc4, so it’s likely that all versions in between are affected. An attacker can read /proc/pid/syscall to trigger this vulnerability, which leads to the kernel leaking memory contents.

CVSS Base Scores

version 3.1