CVE-2020-25643
Severity
7.2HIGH
EPSS
0.4%
top 38.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 6
Latest updateMay 24
Description
A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9
Affected Packages5 packages
Also affects: Debian Linux 10.0, 9.0, Enterprise Linux 7.0, 8.0
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-vhhq-pmj4-x7gm: A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5↗2022-05-24
CVEList▶
CVE-2020-25643: A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5↗2020-10-06
OSV▶
CVE-2020-25643: A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5↗2020-10-06
📋Vendor Advisories
7Microsoft▶
A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function whi↗2020-10-13
💬Community
1Bugzilla▶
CVE-2020-25643 kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow↗2020-09-17