Cloudanix VulnDB

CVE-2020-14871

Critical · 10.0 CISA KEV

CVSS

10.0

EPSS

80.2%

Published

Oct 21, 2020

CISA due date

May 3, 2022

Cloudanix analysis

Act now SSVC: Attend

A serious flaw in the login checking system of certain server software lets remote attackers take full control of the machine without any login credentials.

Active In The Wild
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory corruption in the pluggable authentication module allows unauthenticated remote attackers to achieve full system compromise over the network, with impacts propagating to dependent products.

Why it matters to the business

Enables complete system takeover on affected Solaris 10/11 deployments and listed Linux kernels, creating urgent operational disruption risk; must be remediated by the 2022-05-03 CISA deadline given KEV status and active exploitation in the wild.

How an attack unfolds

Attackers targeting the Oracle Solaris and ZFS unspecified vulnerability send crafted network requests via multiple protocols to the vulnerable PAM component, triggering memory corruption that results in arbitrary code execution and full system takeover; the flaw has seen active exploitation.

How to fix it

Apply the listed fixed versions immediately: Debian linux 5.10.46-1, Ubuntu linux 4.13.0-16.19 or 5.4.0-9.12 (and corresponding aws/azure/kernel variants such as 4.15.0-1001.1, 5.11.0-1017.18~20.04.1, 5.13.0-1008.9~20.04.2, 5.15.0-1014.18~20.04.1). Ensure Solaris 11.1+ or ZFSSA 8.7+ deployments where the issue is not exploitable.

How to confirm the fix worked

Confirm kernel and Solaris package versions match the fixed releases; perform authenticated and unauthenticated network tests against the PAM interfaces to verify no unauthorized access is possible.

Typical attack path

  1. Scan for network-accessible systems running affected Solaris or Linux kernel versions
  2. Send unauthenticated malicious payloads over supported protocols to the PAM component
  3. Trigger memory corruption to bypass authentication and execute code
  4. Escalate to full system compromise and persistence

How to detect it

Review authentication and network logs for anomalous unauthenticated requests to PAM components preceding system anomalies; correlate with threat actor activity targeting Solaris/ZFS environments and check for post-exploitation artifacts on affected kernels.

What your security team should do

  • Prioritize patching all affected systems before the KEV due date due to active exploitation
  • Restrict network exposure of authentication services where upgrades cannot be applied immediately
  • Update threat detection rules to cover memory corruption patterns in PAM
  • Inventory all downstream dependents to assess prevalence impact

The record

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities