CVE-2020-15780: 
Sysdig vulnerability analysis and mitigation

An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30. The vulnerability was discovered by Jason A. Donenfeld and assigned CVE-2020-15780 (NVD, Ubuntu).

The vulnerability exists in the ACPI implementation where it did not properly restrict loading ACPI tables via configfs. The issue allows injection of malicious ACPI tables, which enables arbitrary physical address writes. This capability can be used to disable kernel lockdown and bypass secure boot restrictions (OSS-Security). The vulnerability has a CVSS v3.1 Base Score of 6.7 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (Ubuntu).

A privileged attacker could use this vulnerability to bypass Secure Boot lockdown restrictions and execute arbitrary code in the kernel. This allows loading of unsigned kernel modules on systems with Secure Boot enabled, without requiring module signing (OSS-Security).

The vulnerability requires local access and high privileges to exploit. A proof-of-concept exploit was published demonstrating how the vulnerability could be used to disable kernel lockdown and bypass secure boot restrictions (American-Unsigned-Language).

The vulnerability was fixed in Linux kernel version 5.7.7 by adding a lockdown check before allowing new ACPI tables to be installed via configfs. The fix was also backported to various stable kernel versions. Ubuntu released security updates for affected versions including 20.04 LTS, 18.04 LTS and 16.04 LTS (Ubuntu-USN).