CVE-2020-27777 : A flaw was found in the way RTAS handled memory accesses in userspace to kernel

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.

Published 2020-12-15 17:15:14

Updated 2023-10-05 14:29:58

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2020-27777

Redhat » Enterprise Linux » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 5.0
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Container Platform » Version: 4.4
cpe:2.3:a:redhat:openshift_container_platform:4.4:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Container Platform » Version: 4.5
cpe:2.3:a:redhat:openshift_container_platform:4.5:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Container Platform » Version: 4.6
cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions before (<) 4.14.204
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.5 and before (<) 5.9.5
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.15 and before (<) 4.19.155
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.20 and before (<) 5.4.75
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2020-27777

Top countries where our scanners detected CVE-2020-27777

Top open port discovered on systems with this issue 53

IPs affected by CVE-2020-27777 843,578

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-27777!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-27777

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 19 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-27777

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-27777

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Assigned by: secalert@redhat.com (Primary)

References for CVE-2020-27777

https://bugzilla.redhat.com/show_bug.cgi?id=1900844

1900844 – (CVE-2020-27777) CVE-2020-27777 kernel: powerpc: RTAS calls can be used to compromise kernel integrity
Issue Tracking;Patch;Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/commit/?h=next&id=bd59380c5ba4147dcbaad3e582b55ccfd120b764

kernel/git/powerpc/linux.git - The powerpc tree
Exploit;Patch;Vendor Advisory
https://www.openwall.com/lists/oss-security/2020/11/23/2

oss-security - Re: Linux kernel: powerpc: RTAS calls can be used to compromise kernel integrity
Mailing List;Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/10/09/1

oss-security - Linux kernel: powerpc: RTAS calls can be used to compromise kernel integrity
Exploit;Mailing List;Patch;Third Party Advisory