Code Execution Vulnerability in Microsoft Azure Sphere
CVE-2020-35608

7.8HIGH

Key Information:

Vendor

Microsoft
Status
Azure Sphere
Vendor
CVE Published:
22 December 2020

What is CVE-2020-35608?

A code execution vulnerability exists within the signed code execution functionality of Microsoft Azure Sphere 20.07. This flaw allows an attacker to leverage a specially crafted AF_PACKET socket to create an executable memory mapping containing user-controlled data. By exploiting this vulnerability, an attacker could execute shellcode through the PACKET_MMAP feature, posing significant risks to the security of affected systems.

References

https://www.talosintelligence.com/vulnerability_reports/T...
x_refsource_MISC
https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-35608 : Code Execution Vulnerability in Microsoft Azure Sphere