CVE-2020-10766CWE-440

A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD

Medium · published September 15, 2020

CVSS v3.1
5.5
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00467 · 39.4th percentile
Weakness
CWE-440 · Expected Behavior Violation
Published
2020-09-15T22:10Z
EPSS history
Timeline
  • 15 SEP 22:10Z
    A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD
    cvelistv5