Red Hat Enterprise Linux Atomic Host vulnerabilities

5 CVEs affecting Red Hat Enterprise Linux Atomic Host, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-15707, published 2020-07-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-11477, published 2019-06-19. High severity, CVSS 7.5. EPSS: 98.7% chance of exploitation in the next 30 days. Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker…
CVE-2019-11478, published 2019-06-19. High severity, CVSS 7.5. EPSS: 94.7% chance of exploitation in the next 30 days. Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK)…
CVE-2020-15707, published 2020-07-29. Medium severity, CVSS 6.4. EPSS: 1.6% chance of exploitation in the next 30 days. Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not…
CVE-2020-15705, published 2020-07-29. Medium severity, CVSS 6.4. EPSS: 1.4% chance of exploitation in the next 30 days. GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported…
CVE-2020-15706, published 2020-07-29. Medium severity, CVSS 6.4. EPSS: 1% chance of exploitation in the next 30 days. GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already…