CVE-2020-25285
published 2020-09-13CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a…
PriorityP423medium6.4CVSS 3.1
AVLACHPRHUINSUCHIHAH
EPSS
0.27%
19.4th percentile
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 5.8.10-1 (bookworm) | linux 5.8.10-1 (bookworm) |
| linux | linux_kernel | < 5.8.8 | 5.8.8 |
| linux | linux_kernel | >= 0 < 5.8.10-1 | 5.8.10-1 |
| linux | linux_kernel | >= 0 < 5.8.10-1 | 5.8.10-1 |
| linux | linux_kernel | >= 0 < 5.8.10-1 | 5.8.10-1 |
| linux | linux_kernel | >= 0 < 5.8.10-1 | 5.8.10-1 |
| linux | linux_kernel | >= 0 < 4.4.0-193.224 | 4.4.0-193.224 |
| linux | linux_kernel | >= 0 < 4.15.0-128.131 | 4.15.0-128.131 |
| linux | linux_kernel | >= 0 < 4.15.0-126.129 | 4.15.0-126.129 |
| linux | linux_kernel | >= 0 < 5.4.0-51.56 | 5.4.0-51.56 |
| msrc | cm1_kernel_5.4.91-3_on_cbl_mariner_1.0 | — | — |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.16.4MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian6.4MEDIUM
vendor_msrc6.4MEDIUM
vendor_redhat6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3rfj-rp8x-285j: A race condition between hugetlb sysctl handlers in mm/hugetlb
ghsa_unreviewed·2022-05-24
CVE-2020-25285 [HIGH] CWE-362 GHSA-3rfj-rp8x-285j: A race condition between hugetlb sysctl handlers in mm/hugetlb
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.
OSV
CVE-2020-25285: In hugetlb_sysctl_handler_common and related functions of hugetlb
osv·2021-10-01
CVE-2020-25285 CVE-2020-25285: In hugetlb_sysctl_handler_common and related functions of hugetlb
In hugetlb_sysctl_handler_common and related functions of hugetlb.c, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
linux-oem-5.6 vulnerabilities
osv·2021-04-13·CVSS 7.8
CVE-2021-29154 [HIGH] linux-oem-5.6 vulnerabilities
linux-oem-5.6 vulnerabilities
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
It was discovered that the HID multitouch implementation within the Linux
kernel did not properly validate input events in some situations. A
physically proximate attacker could use this to cause a denial
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-snapdragon regression
osv·2020-12-13·CVSS 7.8
[HIGH] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-snapdragon regression
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-snapdragon regression
USN-4660-1 fixed vulnerabilities in the Linux kernel. Unfortunately,
that update introduced a regression in the software raid10 driver
when used with fstrim that could lead to data corruption. This update
fixes the problem.
Original advisory details:
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
It was discovered that the frame buffer implementation in the Linux kernel
did not
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2020-12-03·CVSS 7.8
CVE-2020-14351 [HIGH] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
It was discovered that the frame buffer implementation in the Linux kernel
did not properly handle some edge cases in software scrollback. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-14390)
It was discovered that the netfilter
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
osv·2020-10-14·CVSS 5.5
CVE-2020-16119 [MEDIUM] linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
leading to an out-of-bounds read vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2020-14314)
David Alan Gilbert discovered tha
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
osv·2020-10-14·CVSS 5.5
CVE-2020-16119 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Wen Xu discovered that the XFS file system in the Linux kernel did not
properly validate inode metadata in some situations. An attacker could use
this to construct a malicious XFS image that, when mounted, could cause a
denial of service (system crash). (CVE-2018-10322)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
le
OSV
CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb
osv·2020-09-13·CVSS 6.4
CVE-2020-25285 [MEDIUM] CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2021-04-13·CVSS 7.8
CVE-2020-14351 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
It was discovered that the HID multitouch implementation within the Linux
kernel did not properly validate input events in som
Ubuntu
Linux kernel regression
vendor_ubuntu·2020-12-13·CVSS 7.8
[HIGH] Linux kernel regression
Title: Linux kernel regression
Summary: USN-4660-1 introduced a regression in the Linux kernel.
USN-4660-1 fixed vulnerabilities in the Linux kernel. Unfortunately,
that update introduced a regression in the software raid10 driver
when used with fstrim that could lead to data corruption. This update
fixes the problem.
Original advisory details:
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
It was discovered that the frame buffer implementation in the Linux kernel
did not properly handle some edge cases in software scrollback. A local
attacker
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-12-03·CVSS 7.8
CVE-2020-14351 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
It was discovered that the frame buffer implementation in the Linux kernel
did not properly handle some edge cases in software scrollback. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-14390)
It was discovered that the netfilter connection tracker for netlink in the
Linux kernel did not properly perform bounds checking in som
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-10-14·CVSS 5.5
CVE-2020-14314 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
leading to an out-of-bounds read vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2020-14314)
David Alan Gilbert discovered that the XFS file system implementation in
the Linux kernel did not properly perform metadata
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-10-14·CVSS 5.5
CVE-2020-16119 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Wen Xu discovered that the XFS file system in the Linux kernel did not
properly validate inode metadata in some situations. An attacker could use
this to construct a malicious XFS image that, when mounted, could cause a
denial of service (system crash). (CVE-2018-10322)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken inde
Red Hat
kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c
vendor_redhat·2020-09-13·CVSS 6.4
CVE-2020-25285 [MEDIUM] CWE-362 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c
kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.
A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on internal variables leading to a system crash or memory corruption.
Statement: This flaw is rated as having Moderate impact as access to write to /proc/sys/vm/nr_hugepages is restricted to root and not available to regular users.
Mitigation: Mitigation for this issue is eit
Microsoft
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory cause a NULL pointer dereference or possibly have u
vendor_msrc·2020-09-08·CVSS 6.4
CVE-2020-25285 [MEDIUM] CWE-362 A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory cause a NULL pointer dereference or possibly have u
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory cause a NULL pointer dereference or possibly have unspecified other impact aka CID-17743798d812.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to addition
Debian
CVE-2020-25285: linux - A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux ke...
vendor_debian·2020·CVSS 6.4
CVE-2020-25285 [MEDIUM] CVE-2020-25285: linux - A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux ke...
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.
Scope: local
bookworm: resolved (fixed in 5.8.10-1)
bullseye: resolved (fixed in 5.8.10-1)
forky: resolved (fixed in 5.8.10-1)
sid: resolved (fixed in 5.8.10-1)
trixie: resolved (fixed in 5.8.10-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-25285 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c
bugzilla·2020-09-25·CVSS 6.4
CVE-2020-25285 [MEDIUM] CVE-2020-25285 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c
CVE-2020-25285 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact
References:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17743798d81238ab13050e8e2833699b54e15467
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.8
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1882592]
---
This was fixed for Fedora with the 5.8.8 stable kernel updates.
---
This flaw is rated as a moderate, access to write to /proc/sys/vm/nr_hugepages is restricted to root and not available to regular users.
Bugzilla
CVE-2020-25285 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c [fedora-all]
bugzilla·2020-09-25·CVSS 6.4
CVE-2020-25285 [MEDIUM] CVE-2020-25285 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c [fedora-all]
CVE-2020-25285 kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multip
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.8https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17743798d81238ab13050e8e2833699b54e15467https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlhttps://lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlhttps://lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlhttps://security.netapp.com/advisory/ntap-20201009-0002/https://twitter.com/grsecurity/status/1303749848898904067https://usn.ubuntu.com/4576-1/https://usn.ubuntu.com/4579-1/https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.8https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17743798d81238ab13050e8e2833699b54e15467https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlhttps://lists.debian.org/debian-lts-announce/2020/10/msg00032.htmlhttps://lists.debian.org/debian-lts-announce/2020/10/msg00034.htmlhttps://security.netapp.com/advisory/ntap-20201009-0002/https://twitter.com/grsecurity/status/1303749848898904067https://usn.ubuntu.com/4576-1/https://usn.ubuntu.com/4579-1/
2020-09-13
Published