Infinite loop in Linux kernel - CVE-2020-25641

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU48941

Infinite loop in Linux kernel - CVE-2020-25641

Published: October 6, 2020 / Updated: December 13, 2020


Vulnerability identifier: #VU48941
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-25641
CWE-ID: CWE-835
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect implementation of biovecs in Linux kernel. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. A local user can issue requests to a block device and perform a denial of service (DoS) attack.


Affected software

Linux kernel
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Ubuntu
openEuler
kernel (Red Hat package)
kernel-rt (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
kernel-alt (Red Hat package)
linux-image-generic (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-4.15.0-126-generic (Ubuntu package)
linux-image-4.15.0-126-generic-lpae (Ubuntu package)
linux-image-4.15.0-126-lowlatency (Ubuntu package)
linux-image-4.15.0-128-lowlatency (Ubuntu package)
linux-image-4.15.0-128-generic-lpae (Ubuntu package)
linux-image-4.15.0-128-generic (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1059-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1061-oracle (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-4.15.0-1074-raspi2 (Ubuntu package)
linux-image-4.15.0-1074-gke (Ubuntu package)
linux-image-4.15.0-1076-gke (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1079-kvm (Ubuntu package)
linux-image-4.15.0-1081-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1088-aws (Ubuntu package)
linux-image-4.15.0-1088-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1090-aws (Ubuntu package)
linux-image-4.15.0-1090-gcp (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1091-snapdragon (Ubuntu package)
linux-image-4.15.0-1093-snapdragon (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-edge (Ubuntu package)
linux-image-4.15.0-1100-azure (Ubuntu package)
linux-image-4.15.0-1102-azure (Ubuntu package)
linux-image-4.15.0-1103-oem (Ubuntu package)
perf-debuginfo
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
kernel-source
kernel-devel
kernel-debugsource
kernel-debuginfo
perf
python2-perf
python2-perf-debuginfo
kernel
python3-perf
python3-perf-debuginfo
bpftool
bpftool-debuginfo
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-oem-osp1 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-5.4.0-51-lowlatency (Ubuntu package)
linux-image-5.4.0-51-generic (Ubuntu package)
linux-image-5.4.0-51-generic-lpae (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1021-raspi (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1026-kvm (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.4.0-1028-aws (Ubuntu package)
linux-image-5.4.0-1028-gcp (Ubuntu package)
linux-image-5.4.0-1028-oracle (Ubuntu package)
linux-image-5.4.0-1031-azure (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.6.0-1048-oem (Ubuntu package)

How to mitigate CVE-2020-25641

Install updates from vendor's website.

Linux kernel - update to 5.9 rc7
kernel (Red Hat package) - addressed in versions 4.18.0-147.34.1.el8_1, 4.18.0-193.40.1.el8_2, 4.18.0-240.el8
kernel-rt (Red Hat package) - update to 4.18.0-193.40.1.rt13.90.el8_2
kernel-alt (Red Hat package) - update to 4.14.0-115.33.1.el7a
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.126.113, 4.15.0.128.115, 5.4.0.51.54
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.126.113, 4.15.0.128.115, 5.4.0.51.54
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.126.113, 4.15.0.128.115, 5.4.0.51.54
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.126.113, 4.15.0.128.115, 5.4.0.51.54
linux-image-virtual-hwe-16.04 (Ubuntu package) - addressed in versions 4.15.0.126.125, 4.15.0.128.127
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.126.125, 4.15.0.128.127, 4.15.0.1103.107, 5.4.0.51.54
linux-image-generic-hwe-16.04 (Ubuntu package) - addressed in versions 4.15.0.126.125, 4.15.0.128.127
linux-image-generic-lpae-hwe-16.04 (Ubuntu package) - addressed in versions 4.15.0.126.125, 4.15.0.128.127
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - addressed in versions 4.15.0.126.125, 4.15.0.128.127
linux-image-4.15.0-126-generic (Ubuntu package) - addressed in versions 4.15.0-126.129, 4.15.0-126.129~16.04.1
linux-image-4.15.0-126-generic-lpae (Ubuntu package) - addressed in versions 4.15.0-126.129, 4.15.0-126.129~16.04.1
linux-image-4.15.0-126-lowlatency (Ubuntu package) - addressed in versions 4.15.0-126.129, 4.15.0-126.129~16.04.1
linux-image-4.15.0-128-lowlatency (Ubuntu package) - addressed in versions 4.15.0-128.131, 4.15.0-128.131~16.04.1
linux-image-4.15.0-128-generic-lpae (Ubuntu package) - addressed in versions 4.15.0-128.131, 4.15.0-128.131~16.04.1
linux-image-4.15.0-128-generic (Ubuntu package) - addressed in versions 4.15.0-128.131, 4.15.0-128.131~16.04.1
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1059.48, 4.15.0.1061.50, 5.4.0.1028.12, 5.4.0.1028.25
linux-image-4.15.0-1059-oracle (Ubuntu package) - addressed in versions 4.15.0-1059.65, 4.15.0-1059.65~16.04.1
linux-image-oracle-lts-18.04 (Ubuntu package) - addressed in versions 4.15.0.1059.69, 4.15.0.1061.71
linux-image-4.15.0-1061-oracle (Ubuntu package) - addressed in versions 4.15.0-1061.67, 4.15.0-1061.67~16.04.1
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.15.0.1074.71, 5.4.0.1021.56
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1074.78, 4.15.0.1076.80, 4.15.0.1088.89, 4.15.0.1090.91, 5.4.0.1028.36
linux-image-gke-4.15 (Ubuntu package) - addressed in versions 4.15.0.1074.78, 4.15.0.1076.80
linux-image-4.15.0-1074-raspi2 (Ubuntu package) - update to 4.15.0-1074.79
linux-image-4.15.0-1074-gke (Ubuntu package) - update to 4.15.0-1074.79
linux-image-4.15.0-1076-gke (Ubuntu package) - update to 4.15.0-1076.81
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1079.75, 4.15.0.1081.77, 5.4.0.1026.24
linux-image-4.15.0-1079-kvm (Ubuntu package) - update to 4.15.0-1079.81
linux-image-4.15.0-1081-kvm (Ubuntu package) - update to 4.15.0-1081.83
linux-image-aws-hwe (Ubuntu package) - addressed in versions 4.15.0.1088.82, 4.15.0.1090.84
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1088.89, 4.15.0.1090.91, 5.4.0.1028.16, 5.4.0.1028.36
linux-image-aws-lts-18.04 (Ubuntu package) - addressed in versions 4.15.0.1088.90, 4.15.0.1090.92
linux-image-4.15.0-1088-aws (Ubuntu package) - addressed in versions 4.15.0-1088.93, 4.15.0-1088.93~16.04.1
linux-image-4.15.0-1088-gcp (Ubuntu package) - addressed in versions 4.15.0-1088.101, 4.15.0-1088.101~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - addressed in versions 4.15.0.1088.106, 4.15.0.1090.108
linux-image-4.15.0-1090-aws (Ubuntu package) - addressed in versions 4.15.0-1090.95, 4.15.0-1090.95~16.04.1
linux-image-4.15.0-1090-gcp (Ubuntu package) - addressed in versions 4.15.0-1090.103, 4.15.0-1090.103~16.04.1
linux-image-snapdragon (Ubuntu package) - addressed in versions 4.15.0.1091.94, 4.15.0.1093.96
linux-image-4.15.0-1091-snapdragon (Ubuntu package) - update to 4.15.0-1091.100
linux-image-4.15.0-1093-snapdragon (Ubuntu package) - update to 4.15.0-1093.102
linux-image-azure-lts-18.04 (Ubuntu package) - addressed in versions 4.15.0.1100.73, 4.15.0.1102.75
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1100.75, 4.15.0.1100.93, 4.15.0.1102.95, 5.4.0.1031.13, 5.4.0.1031.29
linux-image-azure-edge (Ubuntu package) - update to 4.15.0.1100.93
linux-image-4.15.0-1100-azure (Ubuntu package) - addressed in versions 4.15.0-1100.111, 4.15.0-1100.111~14.04.1, 4.15.0-1100.111~16.04.1
linux-image-4.15.0-1102-azure (Ubuntu package) - addressed in versions 4.15.0-1102.113, 4.15.0-1102.113~16.04.1
linux-image-4.15.0-1103-oem (Ubuntu package) - update to 4.15.0-1103.114
perf-debuginfo - update to 4.19.90-2010.2.0.0046
kernel-tools - update to 4.19.90-2010.2.0.0046
kernel-tools-debuginfo - update to 4.19.90-2010.2.0.0046
kernel-tools-devel - update to 4.19.90-2010.2.0.0046
kernel-source - update to 4.19.90-2010.2.0.0046
kernel-devel - update to 4.19.90-2010.2.0.0046
kernel-debugsource - update to 4.19.90-2010.2.0.0046
kernel-debuginfo - update to 4.19.90-2010.2.0.0046
perf - update to 4.19.90-2010.2.0.0046
python2-perf - update to 4.19.90-2010.2.0.0046
python2-perf-debuginfo - update to 4.19.90-2010.2.0.0046
kernel - update to 4.19.90-2010.2.0.0046
python3-perf - update to 4.19.90-2010.2.0.0046
python3-perf-debuginfo - update to 4.19.90-2010.2.0.0046
bpftool - update to 4.19.90-2010.2.0.0046
bpftool-debuginfo - update to 4.19.90-2010.2.0.0046
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-oem-osp1 (Ubuntu package) - update to 5.4.0.51.54
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-5.4.0-51-lowlatency (Ubuntu package) - update to 5.4.0-51.56~18.04.1
linux-image-5.4.0-51-generic (Ubuntu package) - update to 5.4.0-51.56~18.04.1
linux-image-5.4.0-51-generic-lpae (Ubuntu package) - update to 5.4.0-51.56~18.04.1
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-5.4.0-1021-raspi (Ubuntu package) - update to 5.4.0-1021.24~18.04.1
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1021.25
linux-image-raspi (Ubuntu package) - update to 5.4.0.1021.56
linux-image-5.4.0-1026-kvm (Ubuntu package) - update to 5.4.0-1026.27
linux-image-aws (Ubuntu package) - addressed in versions 5.4.0.1028.13, 5.4.0.1028.29
linux-image-5.4.0-1028-aws (Ubuntu package) - update to 5.4.0-1028.29~18.04.1
linux-image-5.4.0-1028-gcp (Ubuntu package) - update to 5.4.0-1028.29~18.04.1
linux-image-5.4.0-1028-oracle (Ubuntu package) - update to 5.4.0-1028.29~18.04.1
linux-image-5.4.0-1031-azure (Ubuntu package) - update to 5.4.0-1031.32~18.04.1
linux-image-oem-20.04 (Ubuntu package) - update to 5.6.0.1048.44
linux-image-5.6.0-1048-oem (Ubuntu package) - update to 5.6.0-1048.52

External References

Related Security Bulletins