PT-2020-5048 · Linux+7 · Linux Kernel+7
Grsecurity
·
Published
2020-09-05
·
Updated
2022-04-28
·
CVE-2020-25285
CVSS v2.0
6.6
Medium
| Vector | AV:L/AC:M/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.8.8
Description
The issue is related to a race condition between hugetlb sysctl handlers in the Linux kernel, which can be exploited by local attackers to corrupt memory, cause a NULL pointer dereference, or have unspecified other impact. This is due to errors in synchronization when using a shared resource.
Recommendations
For Linux kernel versions prior to 5.8.8, update to version 5.8.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the hugetlb sysctl handlers to minimize the risk of exploitation.
Fix
Race Condition
NULL Pointer Dereference
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu