Linux Kernel up to 5.8-rc5 ZRAM Kernel hot_add Kernel Memory resource consumption

Summaryinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 5.8-rc5. Affected by this vulnerability is an unknown functionality of the file /sys/class/zram-control/hot_add of the component ZRAM Kernel Module. This manipulation causes resource consumption (Kernel Memory). This vulnerability appears as CVE-2020-10781. The attack requires local access. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 5.8-rc5 (Operating System) and classified as problematic. Affected by this vulnerability is some unknown processing of the file /sys/class/zram-control/hot_add of the component ZRAM Kernel Module. The manipulation with an unknown input leads to a resource consumption vulnerability (Kernel Memory). The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.

The weakness was presented 09/16/2020 as not defined bug report (Bugzilla). The advisory is shared at bugzilla.redhat.com. This vulnerability is known as CVE-2020-10781 since 03/20/2020. An attack has to be approached locally. Required for exploitation is a single authentication. Technical details are known, but no exploit is available.

Upgrading to version 5.8-rc6 eliminates this vulnerability.

See VDB-161294 and VDB-161290 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.8-rc1
• 5.8-rc2
• 5.8-rc3
• 5.8-rc4
• 5.8-rc5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion