Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel - CVE-2020-25212

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU51433

Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel - CVE-2020-25212

Published: March 12, 2021


Vulnerability identifier: #VU51433
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-25212
CWE-ID: CWE-367
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a TOCTOU mismatch in the NFS client code in the Linux kernel. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code on the system with elevated privileges.

Affected software

Linux kernel
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Virtualization Host - Extended Update Support 4.2 for RHEL
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Slackware Linux
Ubuntu
openEuler
kernel (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
kernel-rt (Red Hat package)
linux-image-generic-lpae-lts-xenial (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-powerpc64-smp-lts-xenial (Ubuntu package)
linux-image-powerpc64-emb-lts-xenial (Ubuntu package)
linux-image-powerpc-smp-lts-xenial (Ubuntu package)
linux-image-powerpc-e500mc-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-powerpc64-smp (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-powerpc-e500mc (Ubuntu package)
linux-image-powerpc-smp (Ubuntu package)
linux-image-powerpc64-emb (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-4.4.0-190-powerpc64-smp (Ubuntu package)
linux-image-4.4.0-190-powerpc64-emb (Ubuntu package)
linux-image-4.4.0-190-generic (Ubuntu package)
linux-image-4.4.0-190-generic-lpae (Ubuntu package)
linux-image-4.4.0-190-lowlatency (Ubuntu package)
linux-image-4.4.0-190-powerpc-e500mc (Ubuntu package)
linux-image-4.4.0-190-powerpc-smp (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1078-aws (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-1080-kvm (Ubuntu package)
linux-image-4.4.0-1114-aws (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.4.0-1139-raspi2 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.4.0-1143-snapdragon (Ubuntu package)
linux-4.4.240/kernel-generic
linux-4.4.240/kernel-huge
linux-4.4.240/kernel-modules
linux-4.4.240/kernel-headers
kernel-alt (Red Hat package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-4.15.0-120-generic-lpae (Ubuntu package)
linux-image-4.15.0-120-lowlatency (Ubuntu package)
linux-image-4.15.0-120-generic (Ubuntu package)
linux-image-4.15.0-121-lowlatency (Ubuntu package)
linux-image-4.15.0-121-generic-lpae (Ubuntu package)
linux-image-4.15.0-121-generic (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1056-oracle (Ubuntu package)
linux-image-4.15.0-1057-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1072-gke (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-4.15.0-1073-raspi2 (Ubuntu package)
linux-image-4.15.0-1077-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-4.15.0-1085-aws (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1086-aws (Ubuntu package)
linux-image-4.15.0-1086-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1089-snapdragon (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-4.15.0-1098-azure (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1099-oem (Ubuntu package)
linux-image-4.15.0-1099-azure (Ubuntu package)
python3-perf-debuginfo
python3-perf
bpftool
bpftool-debuginfo
python2-perf-debuginfo
python2-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-devel
kernel-debugsource
kernel-debuginfo
kernel
python-perf
kernel-debug
kernel-debug-devel
kernel-headers
kernel-tools-libs
kernel-tools-libs-devel
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-48-generic (Ubuntu package)
linux-image-5.4.0-48-generic-lpae (Ubuntu package)
linux-image-5.4.0-48-lowlatency (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1019-raspi (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1024-kvm (Ubuntu package)
linux-image-5.4.0-1025-gcp (Ubuntu package)
linux-image-5.4.0-1025-aws (Ubuntu package)
linux-image-5.4.0-1025-oracle (Ubuntu package)
linux-image-5.4.0-1026-azure (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.6.0-1048-oem (Ubuntu package)
Data Computing Appliance (DCA)
IBM QRadar Network Security
Session Smart Router

How to mitigate CVE-2020-25212

Install updates from vendor's website.

Linux kernel - update to 5.8.3
kernel (Red Hat package) - addressed in versions 3.10.0-693.82.1.el7, 3.10.0-957.70.1.el7, 3.10.0-1062.45.1.el7, 3.10.0-1160.11.1.el7, 3.10.0-1160.15.2.el7
kernel-rt (Red Hat package) - update to 3.10.0-1160.11.1.rt56.1145.el7
Data Computing Appliance (DCA) - update to 4.3.0.0
linux-image-generic-lpae-lts-xenial (Ubuntu package) - update to 4.4.0.190.166
linux-image-generic-lts-xenial (Ubuntu package) - update to 4.4.0.190.166
linux-image-virtual-lts-xenial (Ubuntu package) - update to 4.4.0.190.166
linux-image-powerpc64-smp-lts-xenial (Ubuntu package) - update to 4.4.0.190.166
linux-image-powerpc64-emb-lts-xenial (Ubuntu package) - update to 4.4.0.190.166
linux-image-powerpc-smp-lts-xenial (Ubuntu package) - update to 4.4.0.190.166
linux-image-powerpc-e500mc-lts-xenial (Ubuntu package) - update to 4.4.0.190.166
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to 4.4.0.190.166
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.4.0.190.196, 4.15.0.121.108, 5.4.0.48.51
linux-image-generic (Ubuntu package) - addressed in versions 4.4.0.190.196, 4.15.0.121.108, 5.4.0.48.51
linux-image-powerpc64-smp (Ubuntu package) - update to 4.4.0.190.196
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.4.0.190.196, 4.15.0.121.108, 5.4.0.48.51
linux-image-powerpc-e500mc (Ubuntu package) - update to 4.4.0.190.196
linux-image-powerpc-smp (Ubuntu package) - update to 4.4.0.190.196
linux-image-powerpc64-emb (Ubuntu package) - update to 4.4.0.190.196
linux-image-virtual (Ubuntu package) - addressed in versions 4.4.0.190.196, 4.15.0.121.108, 5.4.0.48.51
linux-image-4.4.0-190-powerpc64-smp (Ubuntu package) - addressed in versions 4.4.0-190.220, 4.4.0-190.220~14.04.1
linux-image-4.4.0-190-powerpc64-emb (Ubuntu package) - addressed in versions 4.4.0-190.220, 4.4.0-190.220~14.04.1
linux-image-4.4.0-190-generic (Ubuntu package) - addressed in versions 4.4.0-190.220, 4.4.0-190.220~14.04.1
linux-image-4.4.0-190-generic-lpae (Ubuntu package) - addressed in versions 4.4.0-190.220, 4.4.0-190.220~14.04.1
linux-image-4.4.0-190-lowlatency (Ubuntu package) - addressed in versions 4.4.0-190.220, 4.4.0-190.220~14.04.1
linux-image-4.4.0-190-powerpc-e500mc (Ubuntu package) - addressed in versions 4.4.0-190.220, 4.4.0-190.220~14.04.1
linux-image-4.4.0-190-powerpc-smp (Ubuntu package) - addressed in versions 4.4.0-190.220, 4.4.0-190.220~14.04.1
linux-image-aws (Ubuntu package) - addressed in versions 4.4.0.1078.75, 4.4.0.1114.119, 5.4.0.1025.10, 5.4.0.1025.26
linux-image-4.4.0-1078-aws (Ubuntu package) - update to 4.4.0-1078.82
linux-image-kvm (Ubuntu package) - addressed in versions 4.4.0.1080.78, 4.15.0.1077.73, 5.4.0.1024.22
linux-image-4.4.0-1080-kvm (Ubuntu package) - update to 4.4.0-1080.87
linux-image-4.4.0-1114-aws (Ubuntu package) - update to 4.4.0-1114.127
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.4.0.1139.139, 4.15.0.1073.70, 5.4.0.1019.54
linux-image-4.4.0-1139-raspi2 (Ubuntu package) - update to 4.4.0-1139.148
linux-image-snapdragon (Ubuntu package) - addressed in versions 4.4.0.1143.135, 4.15.0.1089.92
linux-image-4.4.0-1143-snapdragon (Ubuntu package) - update to 4.4.0-1143.152
linux-4.4.240/kernel-generic - update to 4.4.240
linux-4.4.240/kernel-huge - update to 4.4.240
linux-4.4.240/kernel-modules - update to 4.4.240
linux-4.4.240/kernel-headers - update to 4.4.240_smp
kernel-alt (Red Hat package) - update to 4.14.0-115.32.1.el7a
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-generic-lpae-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.120.121, 4.15.0.1099.103, 5.4.0.48.51
linux-image-4.15.0-120-generic-lpae (Ubuntu package) - update to 4.15.0-120.122~16.04.1
linux-image-4.15.0-120-lowlatency (Ubuntu package) - update to 4.15.0-120.122~16.04.1
linux-image-4.15.0-120-generic (Ubuntu package) - update to 4.15.0-120.122~16.04.1
linux-image-4.15.0-121-lowlatency (Ubuntu package) - update to 4.15.0-121.123
linux-image-4.15.0-121-generic-lpae (Ubuntu package) - update to 4.15.0-121.123
linux-image-4.15.0-121-generic (Ubuntu package) - update to 4.15.0-121.123
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1056.46, 5.4.0.1025.9, 5.4.0.1025.22
linux-image-4.15.0-1056-oracle (Ubuntu package) - update to 4.15.0-1056.61~16.04.1
linux-image-4.15.0-1057-oracle (Ubuntu package) - update to 4.15.0-1057.62
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1057.67
linux-image-4.15.0-1072-gke (Ubuntu package) - update to 4.15.0-1072.76
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1072.76
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1072.76, 4.15.0.1086.87, 5.4.0.1025.22
linux-image-4.15.0-1073-raspi2 (Ubuntu package) - update to 4.15.0-1073.78
linux-image-4.15.0-1077-kvm (Ubuntu package) - update to 4.15.0-1077.79
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1085.81
linux-image-4.15.0-1085-aws (Ubuntu package) - update to 4.15.0-1085.90~16.04.1
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1086.87, 5.4.0.1025.13, 5.4.0.1025.22
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1086.88
linux-image-4.15.0-1086-aws (Ubuntu package) - update to 4.15.0-1086.91
linux-image-4.15.0-1086-gcp (Ubuntu package) - addressed in versions 4.15.0-1086.98, 4.15.0-1086.98~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1086.104
linux-image-4.15.0-1089-snapdragon (Ubuntu package) - update to 4.15.0-1089.98
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1098.74, 4.15.0.1098.92, 5.4.0.1026.9, 5.4.0.1026.25
linux-image-4.15.0-1098-azure (Ubuntu package) - addressed in versions 4.15.0-1098.109~14.04.1, 4.15.0-1098.109~16.04.1
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1099.72
linux-image-4.15.0-1099-oem (Ubuntu package) - update to 4.15.0-1099.109
linux-image-4.15.0-1099-azure (Ubuntu package) - update to 4.15.0-1099.110
python3-perf-debuginfo - update to 4.19.90-2010.2.0.0046
python3-perf - update to 4.19.90-2010.2.0.0046
bpftool - update to 4.19.90-2010.2.0.0046
bpftool-debuginfo - update to 4.19.90-2010.2.0.0046
python2-perf-debuginfo - update to 4.19.90-2010.2.0.0046
python2-perf - update to 4.19.90-2010.2.0.0046
perf-debuginfo - update to 4.19.90-2010.2.0.0046
perf - update to 4.19.90-2010.2.0.0046
kernel-tools-devel - update to 4.19.90-2010.2.0.0046
kernel-tools-debuginfo - update to 4.19.90-2010.2.0.0046
kernel-tools - update to 4.19.90-2010.2.0.0046
kernel-source - update to 4.19.90-2010.2.0.0046
kernel-devel - update to 4.19.90-2010.2.0.0046
kernel-debugsource - update to 4.19.90-2010.2.0.0046
kernel-debuginfo - update to 4.19.90-2010.2.0.0046
kernel - update to 4.19.90-2010.2.0.0046
perf - update to 4.19.91-26
python-perf - update to 4.19.91-26
bpftool - update to 4.19.91-26
kernel - update to 4.19.91-26
kernel-debug - update to 4.19.91-26
kernel-debug-devel - update to 4.19.91-26
kernel-devel - update to 4.19.91-26
kernel-headers - update to 4.19.91-26
kernel-tools - update to 4.19.91-26
kernel-tools-libs - update to 4.19.91-26
kernel-tools-libs-devel - update to 4.19.91-26
IBM QRadar Network Security - addressed in versions 5.4.0.17, 5.5.0.12
linux-image-oem-osp1 (Ubuntu package) - update to 5.4.0.48.51
linux-image-5.4.0-48-generic (Ubuntu package) - update to 5.4.0-48.52~18.04.1
linux-image-5.4.0-48-generic-lpae (Ubuntu package) - update to 5.4.0-48.52~18.04.1
linux-image-5.4.0-48-lowlatency (Ubuntu package) - update to 5.4.0-48.52~18.04.1
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.48.52~18.04.42
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.48.52~18.04.42
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.48.52~18.04.42
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.48.52~18.04.42
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.48.52~18.04.42
linux-image-5.4.0-1019-raspi (Ubuntu package) - update to 5.4.0-1019.21~18.04.1
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1019.23
linux-image-raspi (Ubuntu package) - update to 5.4.0.1019.54
linux-image-5.4.0-1024-kvm (Ubuntu package) - update to 5.4.0-1024.24
linux-image-5.4.0-1025-gcp (Ubuntu package) - update to 5.4.0-1025.25~18.04.1
linux-image-5.4.0-1025-aws (Ubuntu package) - update to 5.4.0-1025.25~18.04.1
linux-image-5.4.0-1025-oracle (Ubuntu package) - update to 5.4.0-1025.25~18.04.1
linux-image-5.4.0-1026-azure (Ubuntu package) - update to 5.4.0-1026.26~18.04.1
Session Smart Router - addressed in versions 5.4.7, 5.5.3
linux-image-oem-20.04 (Ubuntu package) - update to 5.6.0.1048.44
linux-image-5.6.0-1048-oem (Ubuntu package) - update to 5.6.0-1048.52

External References

Related Security Bulletins