CVE-2020-25212 — Time-of-check Time-of-use (TOCTOU) Race Condition in Kernel

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race ConditionCWE-787 — Out-of-bounds Write13 documents9 sources
Severity
7.0HIGHNVD
EPSS
0.1%
top 76.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Linux KernelCanonical Ubuntu LinuxDebian Linux+1 more
Timeline
PublishedSep 9
Latest updateMay 24

Description

A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages3 packages

▶NVDlinux/linux_kernel< 5.8.3
▶Debianlinux/linux_kernel< 5.7.17-1+3
▶NVDopensuse/leap15.1, 15.2+1

Also affects: Debian Linux 9.0, Ubuntu Linux 14.04, 16.04, 18.04, 20.04

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-w56x-hj26-mq65: A TOCTOU mismatch in the NFS client code in the Linux kernel before 5↗2022-05-24
▶
OSV
CVE-2020-25212: A TOCTOU mismatch in the NFS client code in the Linux kernel before 5↗2020-09-09
▶
CVEList
CVE-2020-25212: A TOCTOU mismatch in the NFS client code in the Linux kernel before 5↗2020-09-09
▶

📋Vendor Advisories

7
Ubuntu
Linux kernel (OEM) vulnerabilities↗2021-02-25
▶
Ubuntu
Linux kernel vulnerabilities↗2020-10-14
▶
Ubuntu
Linux kernel vulnerabilities↗2020-09-24
▶
Ubuntu
Linux kernel vulnerabilities↗2020-09-24
▶
Red Hat
kernel: TOCTOU mismatch in the NFS client code↗2020-09-09
▶

💬Community

2
Bugzilla
CVE-2020-25212 kernel: TOCTOU mismatch in the NFS client code↗2020-09-09
▶
Bugzilla
CVE-2020-25212 kernel: TOCTOU mismatch in the NFS client code [fedora-all]↗2020-09-09
▶
CVE-2020-25212 — Linux Kernel vulnerability | cvebase