CVE-2020-25285 — Race Condition in Kernel

CWE-362 — Race ConditionCWE-476 — NULL Pointer DereferenceCWE-787 — Out-of-bounds Write14 documents9 sources
Severity
6.4MEDIUMNVD
EPSS
0.0%
top 86.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux KernelCanonical Ubuntu LinuxDebian Linux
Timeline
PublishedSep 13
Latest updateMay 24

Description

A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.5 | Impact: 5.9

Affected Packages2 packages

▶NVDlinux/linux_kernel< 5.8.8
▶Debianlinux/linux_kernel< 5.8.10-1+3

Also affects: Debian Linux 9.0, Ubuntu Linux 14.04, 16.04, 18.04, 20.04

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-3rfj-rp8x-285j: A race condition between hugetlb sysctl handlers in mm/hugetlb↗2022-05-24
▶
OSV
CVE-2020-25285: In hugetlb_sysctl_handler_common and related functions of hugetlb↗2021-10-01
▶
CVEList
CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb↗2020-09-13
▶
OSV
CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb↗2020-09-13
▶

📋Vendor Advisories

7
Ubuntu
Linux kernel (OEM) vulnerabilities↗2021-04-13
▶
Ubuntu
Linux kernel vulnerabilities↗2020-12-03
▶
Ubuntu
Linux kernel vulnerabilities↗2020-10-14
▶
Ubuntu
Linux kernel vulnerabilities↗2020-10-14
▶
Red Hat
kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c↗2020-09-13
▶

💬Community

2
Bugzilla
CVE-2020-25285 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c↗2020-09-25
▶
Bugzilla
CVE-2020-25285 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c [fedora-all]↗2020-09-25
▶
CVE-2020-25285 — Race Condition in Linux Kernel | cvebase