CVE-2020-10027 HIGH

CVE-2020-10027: ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers

Vendor Zephyrproject-Rtos
Product zephyr
Weakness CWE-697
Published May 11, 2020
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.

Key dates

02Disclosure timeline

May 11, 2020 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2020-11071 False-negative validation results in MINT transactions with invalid baton CVE-2024-39534 Junos OS Evolved: Connections to the network and broadcast address accepted CVE-2022-22203 Junos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC reboot CVE-2025-3102 SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation CVE-2021-3833 Integria IMS incorrect authorization