Memory leak in Linux kernel - CVE-2020-25704

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU55258

Memory leak in Linux kernel - CVE-2020-25704

Published: July 22, 2021 / Updated: December 24, 2021


Vulnerability identifier: #VU55258
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-25704
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the Linux kernel performance monitoring subsystem when using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.


Affected software

Linux kernel
Amazon Linux AMI
F5OS
CentOS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Real Time
Anolis OS
Red Hat Enterprise Linux Server - TUS
Ubuntu
openEuler
Fedora
BIG-IP
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-abi-whitelists
kernel-debug-devel
kernel-devel
kernel-headers
kernel-tools
kernel-tools-libs
kernel-tools-libs-devel
perf
python-perf
kernel-doc
kernel
bpftool
kernel-debug
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
linux-image-4.15.0-133-lowlatency (Ubuntu package)
linux-image-4.15.0-133-generic (Ubuntu package)
linux-image-4.15.0-133-generic-lpae (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-4.15.0-135-generic (Ubuntu package)
linux-image-4.15.0-135-lowlatency (Ubuntu package)
linux-image-4.15.0-135-generic-lpae (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1064-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-4.15.0-1078-raspi2 (Ubuntu package)
linux-image-4.15.0-1078-gke (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1084-kvm (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-4.15.0-1092-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1093-aws (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1095-snapdragon (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1106-azure (Ubuntu package)
kernel-modules
kernel-modules-extra
python3-perf
kernel-core
kernel-cross-headers
kernel-debug-core
kernel-debug-modules
kernel-debug-modules-extra
kernel-tools-debuginfo
kernel-tools-devel
bpftool-debuginfo
python2-perf
kernel-debuginfo
perf-debuginfo
kernel-debugsource
python3-perf-debuginfo
python2-perf-debuginfo
kernel-source
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-59-generic (Ubuntu package)
linux-image-5.4.0-59-generic-lpae (Ubuntu package)
linux-image-5.4.0-59-lowlatency (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1026-raspi (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1031-kvm (Ubuntu package)
linux-image-5.4.0-1033-gcp (Ubuntu package)
linux-image-5.4.0-1033-gke (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.4.0-1034-aws (Ubuntu package)
linux-image-5.4.0-1034-oracle (Ubuntu package)
linux-image-5.4.0-1035-azure (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.6.0-1048-oem (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-5.8.0-44-generic-64k (Ubuntu package)
linux-image-5.8.0-44-generic-lpae (Ubuntu package)
linux-image-5.8.0-44-generic (Ubuntu package)
linux-image-5.8.0-44-lowlatency (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-5.8.0-1016-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.8.0-1016-raspi-nolpae (Ubuntu package)
linux-image-5.8.0-1019-kvm (Ubuntu package)
linux-image-5.8.0-1021-oracle (Ubuntu package)
linux-image-5.8.0-1023-gcp (Ubuntu package)
linux-image-5.8.0-1023-azure (Ubuntu package)
linux-image-5.8.0-1024-aws (Ubuntu package)
Red Hat OpenShift Container Platform
IBM Elastic Storage System
Red Hat Advanced Cluster Management for Kubernetes
IBM Spectrum Protect Plus
BIG-IQ Centralized Management
Juniper Junos Space
XtremIO X2

How to mitigate CVE-2020-25704

Install update from vendor's website.

Linux kernel - update to 5.10 rc3
kernel (Red Hat package) - addressed in versions 3.10.0-1160.53.1.el7, 4.18.0-193.60.2.el8_2
Red Hat OpenShift Container Platform - update to 3.11.570
kernel-rt (Red Hat package) - addressed in versions 3.10.0-1160.53.1.rt56.1193.el7, 4.18.0-193.60.2.rt13.112.el8_2
IBM Elastic Storage System - addressed in versions 6.0.2.3, 6.1.2
Red Hat Advanced Cluster Management for Kubernetes - update to 2.3.6
kernel-abi-whitelists - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2
kernel-debug-devel - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2, 4.19.91-26
kernel-devel - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2, 4.19.91-26
kernel-headers - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2, 4.19.91-26
kernel-tools - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2, 4.19.91-26
kernel-tools-libs - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2, 4.19.91-26
kernel-tools-libs-devel - addressed in versions 3.10.0-1160.53.1.0.1, 4.19.91-26
perf - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2, 4.19.91-26
python-perf - addressed in versions 3.10.0-1160.53.1.0.1, 4.19.91-26
kernel-doc - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2
kernel - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2, 4.19.91-26
bpftool - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2, 4.19.91-26
kernel-debug - addressed in versions 3.10.0-1160.53.1.0.1, 4.18.0-193.60.2, 4.19.91-26
kernel - update to 4.14.209-117.337
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.133.131
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.133.131, 5.4.0.59.62, 5.4.0.59.65~18.04.54
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.133.131
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.133.131
linux-image-generic-lpae-hwe-16.04 (Ubuntu package) - update to 4.15.0.133.131
linux-image-4.15.0-133-lowlatency (Ubuntu package) - update to 4.15.0-133.137~16.04.1
linux-image-4.15.0-133-generic (Ubuntu package) - update to 4.15.0-133.137~16.04.1
linux-image-4.15.0-133-generic-lpae (Ubuntu package) - update to 4.15.0-133.137~16.04.1
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.135.122, 5.4.0.59.62, 5.8.0.44.49
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.135.122, 5.4.0.59.62, 5.8.0.44.49
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.135.122, 5.4.0.59.62, 5.8.0.44.49
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.135.122, 5.4.0.59.62, 5.8.0.44.49
linux-image-4.15.0-135-generic (Ubuntu package) - update to 4.15.0-135.139
linux-image-4.15.0-135-lowlatency (Ubuntu package) - update to 4.15.0-135.139
linux-image-4.15.0-135-generic-lpae (Ubuntu package) - update to 4.15.0-135.139
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1064.52, 5.4.0.1034.31, 5.4.0.1034.36~18.04.18, 5.8.0.1021.20
linux-image-4.15.0-1064-oracle (Ubuntu package) - addressed in versions 4.15.0-1064.71, 4.15.0-1064.71~16.04.1
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1064.74
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.15.0.1078.75, 5.4.0.1026.61
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1078.82, 4.15.0.1092.93, 5.8.0.1023.23
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1078.82
linux-image-4.15.0-1078-raspi2 (Ubuntu package) - update to 4.15.0-1078.83
linux-image-4.15.0-1078-gke (Ubuntu package) - update to 4.15.0-1078.83
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1084.80, 5.4.0.1031.29, 5.8.0.1019.21
linux-image-4.15.0-1084-kvm (Ubuntu package) - update to 4.15.0-1084.86
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1092.93, 5.4.0.1033.21, 5.4.0.1033.42, 5.8.0.1023.23
linux-image-4.15.0-1092-gcp (Ubuntu package) - addressed in versions 4.15.0-1092.105, 4.15.0-1092.105~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1092.110
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1093.86
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1093.96
linux-image-4.15.0-1093-aws (Ubuntu package) - addressed in versions 4.15.0-1093.99, 4.15.0-1093.99~16.04.1
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1095.98
linux-image-4.15.0-1095-snapdragon (Ubuntu package) - update to 4.15.0-1095.104
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1106.79, 4.15.0.1106.97, 5.4.0.1035.17, 5.4.0.1035.33, 5.8.0.1023.23
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1106.79
linux-image-4.15.0-1106-azure (Ubuntu package) - addressed in versions 4.15.0-1106.118, 4.15.0-1106.118~14.04.1, 4.15.0-1106.118~16.04.1
kernel-modules - update to 4.18.0-193.60.2
kernel-modules-extra - update to 4.18.0-193.60.2
python3-perf - update to 4.18.0-193.60.2
kernel-core - update to 4.18.0-193.60.2
kernel-cross-headers - update to 4.18.0-193.60.2
kernel-debug-core - update to 4.18.0-193.60.2
kernel-debug-modules - update to 4.18.0-193.60.2
kernel-debug-modules-extra - update to 4.18.0-193.60.2
kernel-tools-debuginfo - update to 4.19.90-2012.5.0.0054
kernel-devel - update to 4.19.90-2012.5.0.0054
kernel-tools-devel - update to 4.19.90-2012.5.0.0054
bpftool-debuginfo - update to 4.19.90-2012.5.0.0054
python3-perf - update to 4.19.90-2012.5.0.0054
python2-perf - update to 4.19.90-2012.5.0.0054
kernel-tools - update to 4.19.90-2012.5.0.0054
kernel-debuginfo - update to 4.19.90-2012.5.0.0054
perf-debuginfo - update to 4.19.90-2012.5.0.0054
kernel-debugsource - update to 4.19.90-2012.5.0.0054
bpftool - update to 4.19.90-2012.5.0.0054
python3-perf-debuginfo - update to 4.19.90-2012.5.0.0054
kernel - update to 4.19.90-2012.5.0.0054
python2-perf-debuginfo - update to 4.19.90-2012.5.0.0054
kernel-source - update to 4.19.90-2012.5.0.0054
perf - update to 4.19.90-2012.5.0.0054
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.4.0.59.62, 5.4.0.59.65~18.04.54
linux-image-5.4.0-59-generic (Ubuntu package) - addressed in versions 5.4.0-59.65, 5.4.0-59.65~18.04.1
linux-image-5.4.0-59-generic-lpae (Ubuntu package) - addressed in versions 5.4.0-59.65, 5.4.0-59.65~18.04.1
linux-image-5.4.0-59-lowlatency (Ubuntu package) - addressed in versions 5.4.0-59.65, 5.4.0-59.65~18.04.1
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.59.65~18.04.54
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.59.65~18.04.54
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.59.65~18.04.54
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.59.65~18.04.54
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.59.65~18.04.54
linux-image-5.4.0-1026-raspi (Ubuntu package) - addressed in versions 5.4.0-1026.29, 5.4.0-1026.29~18.04.1
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1026.30
linux-image-raspi (Ubuntu package) - addressed in versions 5.4.0.1026.61, 5.8.0.1016.19
linux-image-5.4.0-1031-kvm (Ubuntu package) - update to 5.4.0-1031.32
linux-image-5.4.0-1033-gcp (Ubuntu package) - addressed in versions 5.4.0-1033.35, 5.4.0-1033.35~18.04.1
linux-image-5.4.0-1033-gke (Ubuntu package) - update to 5.4.0-1033.35~18.04.1
linux-image-gke-5.4 (Ubuntu package) - update to 5.4.0.1033.35~18.04.2
linux-image-aws (Ubuntu package) - addressed in versions 5.4.0.1034.19, 5.4.0.1034.35, 5.8.0.1024.26
linux-image-5.4.0-1034-aws (Ubuntu package) - addressed in versions 5.4.0-1034.35, 5.4.0-1034.35~18.04.1
linux-image-5.4.0-1034-oracle (Ubuntu package) - addressed in versions 5.4.0-1034.36, 5.4.0-1034.36~18.04.1
linux-image-5.4.0-1035-azure (Ubuntu package) - addressed in versions 5.4.0-1035.36, 5.4.0-1035.36~18.04.1
linux-image-oem-20.04 (Ubuntu package) - addressed in versions 5.6.0.1048.44, 5.8.0.44.49
linux-image-5.6.0-1048-oem (Ubuntu package) - update to 5.6.0-1048.52
linux-image-generic-64k (Ubuntu package) - update to 5.8.0.44.49
linux-image-5.8.0-44-generic-64k (Ubuntu package) - update to 5.8.0-44.50
linux-image-5.8.0-44-generic-lpae (Ubuntu package) - update to 5.8.0-44.50~20.04.1
linux-image-5.8.0-44-generic (Ubuntu package) - update to 5.8.0-44.50~20.04.1
linux-image-5.8.0-44-lowlatency (Ubuntu package) - update to 5.8.0-44.50~20.04.1
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.8.0.44.50~20.04.30
linux-image-5.8.0-1016-raspi (Ubuntu package) - update to 5.8.0-1016.19
linux-image-raspi-nolpae (Ubuntu package) - update to 5.8.0.1016.19
linux-image-5.8.0-1016-raspi-nolpae (Ubuntu package) - update to 5.8.0-1016.19
linux-image-5.8.0-1019-kvm (Ubuntu package) - update to 5.8.0-1019.21
linux-image-5.8.0-1021-oracle (Ubuntu package) - update to 5.8.0-1021.22
linux-image-5.8.0-1023-gcp (Ubuntu package) - update to 5.8.0-1023.24
linux-image-5.8.0-1023-azure (Ubuntu package) - update to 5.8.0-1023.25
linux-image-5.8.0-1024-aws (Ubuntu package) - update to 5.8.0-1024.26
kernel-headers - addressed in versions 5.9.7-100.fc32, 5.9.7-200.fc33
kernel-tools - addressed in versions 5.9.7-100.fc32, 5.9.7-200.fc33
kernel - addressed in versions 5.9.8-100.fc32, 5.9.8-200.fc33
XtremIO X2 - update to 6.4.2-13
IBM Spectrum Protect Plus - update to 10.1.11
Juniper Junos Space - update to 22.1R1

External References

Related Security Bulletins