CVE-2020-10768

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-440

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-107695.5A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec CryptograpCVE-2020-10777.8An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully eCVE-2020-107705.3A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter CVE-2020-107717.1A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. CVE-2020-107727.5An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable veCVE-2020-107734.4A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to theCVE-2020-107745.5A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/kCVE-2020-107755.3An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbCVE-2020-107764.8A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allCVE-2020-107775.4A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a sCVE-2020-107786.0In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fiCVE-2020-107796.5Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing pri