LinuxKI, through version 6.0-1, contains a remote code execution flaw, which is fixed in release 6.0-2. The available details do not specify the affected component, the attack vector, or the conditions an attacker would need to meet to exploit it.
First seen exploited 3 years after disclosure. Public exploit code (Metasploit) appeared 3 months after disclosure.
Remote code execution flaw implies network-facing exploitation
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution
RCE grants command/code execution on the host
is vulnerable to an remote code execution which is resolved in release 6.0-2
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2020-7209 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Microsoft researchers have also identified that previous reports have used the vulnerability ID “ZERO-32906” for CVE-2018-20057, “GPON” for CVE-2018-10561, and “DLINK” for CVE-2016-20017; and that CVE-2020-7209 was mislabeled as CVE-2017-17106 and CVE-2022-42013 was mislabeled as CVE-2021-42013.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.