CVE-2019-20908

6.7 mediumEPSS 0.5%

Medium (6.7). EPSS 0.5% chance of exploitation in the next 30 days.

An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032.

Severity

CVSS 3.1

6.7 medium

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
Published: 2020-07-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

canonical:ubuntu_linux
linux:linux_kernel
opensuse:leap

References

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
http://www.openwall.com/lists/oss-security/2020/07/20/6
http://www.openwall.com/lists/oss-security/2020/07/29/3
http://www.openwall.com/lists/oss-security/2020/07/30/2
http://www.openwall.com/lists/oss-security/2020/07/30/3

Check your stack JSON