CVE-2020-10067CWE-190

Integer Overflow In is_in_region Allows User Thread To Access Kernel Memory

High · published May 11, 2020

CVSS v3.1
7.5
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers. The impact would depend on the underlying system call and can range from denial of service to information leak to memory corruption resulting in code execution within the kernel. See NCC-ZEP-005 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00446 · 37.8th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2020-05-11T22:26Z
EPSS history
Timeline
  • 11 MAY 22:26Z
    Integer Overflow In is_in_region Allows User Thread To Access Kernel Memory
    cvelistv5