SecBoard
Zurück zur CVE-Übersicht

CVE-2020-12769

MEDIUM(5.5)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Risk Signal Score14/100 — NIEDRIG
  • CVSS 5.5 — Mittel

EPSS-Score

0.7%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

5.5

Technische Schwere

Beschreibung

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • Linux 5.4.17

Threat-Hunting-Queries

Detecting kernel panics related to the spi-dw driver. This query looks for specific call trace elements indicative of the vulnerability.

Sentinel/Defender KQL

DeviceEvents
| where ActionType == "KernelPanic" or ReportId == "KernelPanic"
| where AdditionalFields contains "dw_writer" and AdditionalFields contains "dw_spi_irq" and AdditionalFields contains "dw_spi_transfer_one"
| project TimeGenerated, DeviceName, AdditionalFields, ReportId

Splunk SPL

index=* (kernelpanic OR "Call trace") "dw_writer" "dw_spi_irq" "dw_spi_transfer_one"

Sigma

title: Linux Kernel SPI-DW Panic
status: experimental
description: Detects potential kernel panics related to concurrent calls in the spi-dw driver (CVE-2020-12769).
logsource:
  product: linux
  service: kernel
detection:
  selection:
    keywords:
      - 'kernel panic'
      - 'Call trace'
      - 'dw_writer'
      - 'dw_spi_irq'
      - 'dw_spi_transfer_one'
  condition: selection
level: high

Elastic ES|QL

from logs-system.*
| where message : "kernel panic" or message : "Call trace"
| where message : "dw_writer" and message : "dw_spi_irq" and message : "dw_spi_transfer_one"
| sort @timestamp desc

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • 19b61392c5a852b4e8a0bf35aecb969983c5932d

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Betroffene Produkte

  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Referenzen