Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog
Консоль
Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog

exploitDog

fstec Π»ΠΎΠ³ΠΎΡ‚ΠΈΠΏ

BDU:2020-01463

ΠžΠΏΡƒΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½ΠΎ: 16 Π°ΠΏΡ€. 2019
Π˜ΡΡ‚ΠΎΡ‡Π½ΠΈΠΊ: fstec
CVSS3: 4.3
CVSS2: 4
EPSS Низкий

ОписаниС

Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ Ρ„ΡƒΠ½ΠΊΡ†ΠΈΠΈ SMB2_read (fs/cifs/smb2pdu.c) ядра ΠΎΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΎΠ½Π½ΠΎΠΉ систСмы Linux связана с использованиСм памяти послС Π΅Ρ‘ освобоТдСния. Эксплуатация уязвимости ΠΌΠΎΠΆΠ΅Ρ‚ ΠΏΠΎΠ·Π²ΠΎΠ»ΠΈΡ‚ΡŒ Π½Π°Ρ€ΡƒΡˆΠΈΡ‚Π΅Π»ΡŽ ΠΎΠΊΠ°Π·Π°Ρ‚ΡŒ воздСйствиС Π½Π° ΠΊΠΎΠ½Ρ„ΠΈΠ΄Π΅Π½Ρ†ΠΈΠ°Π»ΡŒΠ½ΠΎΡΡ‚ΡŒ, Ρ†Π΅Π»ΠΎΡΡ‚Π½ΠΎΡΡ‚ΡŒ ΠΈ Π΄ΠΎΡΡ‚ΡƒΠΏΠ½ΠΎΡΡ‚ΡŒ Π·Π°Ρ‰ΠΈΡ‰Π°Π΅ΠΌΠΎΠΉ ΠΈΠ½Ρ„ΠΎΡ€ΠΌΠ°Ρ†ΠΈΠΈ

Π’Π΅Π½Π΄ΠΎΡ€

Novell Inc.
БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния

НаимСнованиС ПО

Suse Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Module for Open Buildservice Development Tools
Suse Linux Enterprise Server
SUSE Linux Enterprise Module for Basesystem
OpenSUSE Leap
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Build System Kit
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Live Patching
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Module for Public Cloud
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Realtime packages
SUSE Linux Enterprise Real Time Extension
Linux

ВСрсия ПО

12 SP4 (Suse Linux Enterprise Desktop)
12 SP4 (SUSE Linux Enterprise Server for SAP Applications)
12 SP4 (SUSE Linux Enterprise Software Development Kit)
12 SP4 (SUSE Linux Enterprise Workstation Extension)
15 (SUSE Linux Enterprise Module for Open Buildservice Development Tools)
12 SP4 (Suse Linux Enterprise Server)
15 (SUSE Linux Enterprise Module for Basesystem)
15 SP1 (SUSE Linux Enterprise Module for Basesystem)
15.0 (OpenSUSE Leap)
15 (SUSE Linux Enterprise Module for Development Tools)
15 SP1 (SUSE Linux Enterprise Module for Development Tools)
12 SP4 (SUSE Linux Enterprise Build System Kit)
12 SP4 (SUSE Linux Enterprise High Availability)
15 (SUSE Linux Enterprise High Availability)
15 SP1 (SUSE Linux Enterprise High Availability)
12 SP4 (SUSE Linux Enterprise Live Patching)
15 SP1 (SUSE Linux Enterprise Module for Legacy Software)
15 (SUSE Linux Enterprise Module for Legacy Software)
15 (SUSE Linux Enterprise Module for Public Cloud)
15 (SUSE Linux Enterprise Workstation Extension)
15 SP1 (SUSE Linux Enterprise Workstation Extension)
15 SP1 (SUSE Linux Enterprise Module for Open Buildservice Development Tools)
15.1 (OpenSUSE Leap)
12 SP5 (Suse Linux Enterprise Server)
12 SP5 (SUSE Linux Enterprise Software Development Kit)
15 SP1 (SUSE Linux Enterprise Module for Public Cloud)
12 SP5 (SUSE Linux Enterprise High Performance Computing)
12 SP5 (SUSE Linux Enterprise High Availability)
15 SP1 (SUSE Linux Enterprise Module for Realtime packages)
12 SP4 (SUSE Linux Enterprise Real Time Extension)
12 SP5 (SUSE Linux Enterprise Workstation Extension)
ΠΎΡ‚ 4.20 Π΄ΠΎ 5.0.10 Π²ΠΊΠ»ΡŽΡ‡ΠΈΡ‚Π΅Π»ΡŒΠ½ΠΎ (Linux)
ΠΎΡ‚ 4.18 Π΄ΠΎ 4.19.37 Π²ΠΊΠ»ΡŽΡ‡ΠΈΡ‚Π΅Π»ΡŒΠ½ΠΎ (Linux)

Вип ПО

ΠžΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΎΠ½Π½Π°Ρ систСма
ΠŸΡ€ΠΈΠΊΠ»Π°Π΄Π½ΠΎΠ΅ ПО ΠΈΠ½Ρ„ΠΎΡ€ΠΌΠ°Ρ†ΠΈΠΎΠ½Π½Ρ‹Ρ… систСм

ΠžΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΎΠ½Π½Ρ‹Π΅ систСмы ΠΈ Π°ΠΏΠΏΠ°Ρ€Π°Ρ‚Π½Ρ‹Π΅ ΠΏΠ»Π°Ρ‚Ρ„ΠΎΡ€ΠΌΡ‹

Novell Inc. OpenSUSE Leap 15.0
Novell Inc. OpenSUSE Leap 15.1
БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния Linux Π΄ΠΎ 5.0.10

Π£Ρ€ΠΎΠ²Π΅Π½ΡŒ опасности уязвимости

Π‘Ρ€Π΅Π΄Π½ΠΈΠΉ ΡƒΡ€ΠΎΠ²Π΅Π½ΡŒ опасности (базовая ΠΎΡ†Π΅Π½ΠΊΠ° CVSS 2.0 составляСт 4)
Π‘Ρ€Π΅Π΄Π½ΠΈΠΉ ΡƒΡ€ΠΎΠ²Π΅Π½ΡŒ опасности (базовая ΠΎΡ†Π΅Π½ΠΊΠ° CVSS 3.0 составляСт 4,3)

Π’ΠΎΠ·ΠΌΠΎΠΆΠ½Ρ‹Π΅ ΠΌΠ΅Ρ€Ρ‹ ΠΏΠΎ ΡƒΡΡ‚Ρ€Π°Π½Π΅Π½ΠΈΡŽ уязвимости

ИспользованиС Ρ€Π΅ΠΊΠΎΠΌΠ΅Π½Π΄Π°Ρ†ΠΈΠΉ:
Для Linux:
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.10
Для ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½Ρ‹Ρ… ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚ΠΎΠ² Novell Inc.:
https://www.suse.com/security/cve/CVE-2019-15920/

Бтатус уязвимости

ΠŸΠΎΠ΄Ρ‚Π²Π΅Ρ€ΠΆΠ΄Π΅Π½Π° ΠΏΡ€ΠΎΠΈΠ·Π²ΠΎΠ΄ΠΈΡ‚Π΅Π»Π΅ΠΌ

НаличиС эксплойта

БущСствуСт

Π˜Π½Ρ„ΠΎΡ€ΠΌΠ°Ρ†ΠΈΡ ΠΎΠ± устранСнии

Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ устранСна

Π˜Π΄Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ‚ΠΎΡ€Ρ‹ Π΄Ρ€ΡƒΠ³ΠΈΡ… систСм описаний уязвимостСй

EPSS

ΠŸΡ€ΠΎΡ†Π΅Π½Ρ‚ΠΈΠ»ΡŒ: 76%
0.01767
Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

БвязанныС уязвимости

CVSS3: 4.3
ubuntu
ΠΏΠΎΡ‡Ρ‚ΠΈ 7 Π»Π΅Ρ‚ Π½Π°Π·Π°Π΄

An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog, which documents a memory leak.

CVSS3: 3.3
redhat
ΠΏΠΎΡ‡Ρ‚ΠΈ 7 Π»Π΅Ρ‚ Π½Π°Π·Π°Π΄

An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog, which documents a memory leak.

CVSS3: 4.3
nvd
ΠΏΠΎΡ‡Ρ‚ΠΈ 7 Π»Π΅Ρ‚ Π½Π°Π·Π°Π΄

An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog, which documents a memory leak.

CVSS3: 4.3
debian
ΠΏΠΎΡ‡Ρ‚ΠΈ 7 Π»Π΅Ρ‚ Π½Π°Π·Π°Π΄

An issue was discovered in the Linux kernel before 5.0.10. SMB2_read i ...

github
большС 4 Π»Π΅Ρ‚ Π½Π°Π·Π°Π΄

An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog, which documents a memory leak.

EPSS

ΠŸΡ€ΠΎΡ†Π΅Π½Ρ‚ΠΈΠ»ΡŒ: 76%
0.01767
Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ BDU:2020-01463