PT-2020-5127 · Linux+7 · Linux Kernel+7
Published
2020-08-12
·
Updated
2022-04-28
·
CVE-2020-25212
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.8.3
Description
The issue is related to a TOCTOU mismatch in the NFS client code, which could allow local attackers to corrupt memory or have other unspecified impacts. This is due to a size check being in the wrong location, specifically in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c. The vulnerability is also described as being related to an authentication check error in the Network File System (NFS) of Linux operating systems, which could allow an attacker to elevate their privileges or execute arbitrary code.
Recommendations
For Linux kernel versions prior to 5.8.3, update to version 5.8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the NFS client code to minimize the risk of exploitation.
Fix
Time Of Check To Time Of Use
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu