CVE-2020-10781: 
Sysdig vulnerability analysis and mitigation

A flaw was discovered in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. The vulnerability was discovered by Luca Bruno of Red Hat and was assigned CVE-2020-10781. The issue was disclosed on June 18, 2020, and affects Linux kernel versions prior to 5.8-rc6 (Kernel Commit, OSS Security).

The vulnerability stems from improper permission settings on the ZRAM control file /sys/class/zram-control/hot_add. Each read operation on this file creates a ZRAM device node in the /dev/ directory, allocating kernel memory that is not accounted for the user triggering the creation. The issue has a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat Bugzilla).

When exploited, continually reading the vulnerable file can consume a large amount of system memory and trigger the Out-of-Memory (OOM) killer to activate. This results in the termination of random userspace processes, potentially making the system inoperable. The impact is rated as Low severity because it requires the ZRAM kernel module to be loaded, which is not the default configuration, and loading kernel modules is a privileged operation (Red Hat Bugzilla).

The vulnerability requires local access and the ability to read the /sys/class/zram-control/hot_add file. The attack can be executed by any local user with basic file read permissions on the affected system where the ZRAM module is loaded (Ubuntu Security).

A temporary mitigation involves changing permissions on the files within /sys to prevent regular users from triggering this issue. However, these permission changes do not persist between reboots and need to be reapplied after each boot. The permanent fix was implemented in Linux kernel 5.8-rc6 by reverting the previous permission changes and setting the correct file permissions to 0400 (Kernel Commit).