PT-2020-16024 · Linux+1 · Linux Kernel+1

Andy Lutomirski · Published 2020-09-10 · Updated 2023-02-02 · CVE-2020-25221

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.7.x through 5.8.6

Description The issue is related to incorrect reference counting of the struct page that backs the vsyscall page, caused by gate page mishandling in the get gate page function in mm/gup.c. This results in a refcount underflow, allowing privilege escalation. The issue can be triggered by any 64-bit process that can use ptrace() or process vm readv().

Recommendations For Linux kernel versions 5.7.x through 5.8.6, update to version 5.8.7 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-672

Related Identifiers

ALT-PU-2020-2757

ALT-PU-2020-2770

ALT-PU-2020-3210

ALT-PU-2020-3553

ALT-PU-2021-1083

ALT-PU-2021-1105

CVE-2020-25221

MGASA-2020-0392

Affected Products

Alt Linux

Linux Kernel

References · 29

• https://git.kernel.org/linus/9fa2dd946743ae6f30dc4830da19147bf100a7f2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25221 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0392 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25221 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0392.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-25221 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25221 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-25221 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25221 · Vendor Advisory
• https://git.kernel.org/linus/8891adc61dce2a8a41fc0c23262b681c3ec4b73a · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7 · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/09/08/4 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25221 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2020-24490 · Note
• http://openwall.com/lists/oss-security/2020/09/10/4 · Note