CVE-2020-25705Use of Insufficiently Random Values in Kernel

Severity
7.4HIGHNVD
OSV8.2OSV7.8OSV5.5
EPSS
1.0%
top 22.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedNov 17
Latest updateMar 14

Description

A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions pri

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2

Affected Packages6 packages

NVDlinux/linux_kernel< 5.10.0
Debianlinux/linux_kernel< 5.9.6-1+3
Ubuntulinux/linux_kernel< 4.4.0-197.229+3
debiandebian/linux< linux 5.9.6-1 (bookworm)

Also affects: Enterprise Linux 7.0, 8.0

🔴Vulnerability Details

7
GHSA
GHSA-33cf-w34p-g6pj: A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports2022-05-24
OSV
CVE-2020-25705: In icmp_global_allow of icmp2021-04-01
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities2021-01-06
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 regression2020-12-13
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities2020-12-03

📋Vendor Advisories

12
CISA ICS
Siemens SIMATIC2024-03-14
CISA ICS
Siemens Linux-based Products (Update J)2022-08-11
Android
CVE-2020-25705: ICMP2021-04-01
Ubuntu
Linux kernel vulnerabilities2021-01-06
Ubuntu
Linux kernel regression2020-12-13

🕵️Threat Intelligence

1
Tenable
Microsoft’s December 2020 Patch Tuesday Addresses 58 CVEs including CVE-2020-25705 (SAD DNS)2020-12-08

📄Research Papers

1
arXiv
From IP to transport and beyond: cross-layer attacks against applications2022-05-12

💬Community

1
Bugzilla
CVE-2020-25705 kernel: ICMP rate limiting can be used for DNS poisoning attack2020-11-04