CVE-2020-25643 : A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5

A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Published 2020-10-06 14:15:13

Updated 2023-05-16 10:48:49

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Memory CorruptionInput validationDenial of service

Products affected by CVE-2020-25643

Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.5 and before (<) 4.9.238
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.15 and before (<) 4.19.148
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 2.6.29 and before (<) 4.4.238
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.20 and before (<) 5.4.68
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.5 and before (<) 5.8.12
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.10 and before (<) 4.14.200
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 5.9.0 Update RC1
cpe:2.3:o:linux:linux_kernel:5.9.0:rc1:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 5.9.0 Update RC2
cpe:2.3:o:linux:linux_kernel:5.9.0:rc2:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 5.9.0 Update RC3
cpe:2.3:o:linux:linux_kernel:5.9.0:rc3:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 5.9.0 Update RC4
cpe:2.3:o:linux:linux_kernel:5.9.0:rc4:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 5.9.0 Update RC5
cpe:2.3:o:linux:linux_kernel:5.9.0:rc5:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 5.9.0 Update RC6
cpe:2.3:o:linux:linux_kernel:5.9.0:rc6:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.2
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Matching versions
Netapp » H410c Firmware » Version: N/A
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410c » Version: N/A
Starwindsoftware » Starwind Virtual San » Version: V8 Update Build12533 For Vsphere
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12533:*:*:*:vsphere:*:*
Matching versions
Starwindsoftware » Starwind Virtual San » Version: V8 Update Build12658 For Vsphere
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12658:*:*:*:vsphere:*:*
Matching versions
Starwindsoftware » Starwind Virtual San » Version: V8 Update Build12859 For Vsphere
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12859:*:*:*:vsphere:*:*
Matching versions
Starwindsoftware » Starwind Virtual San » Version: V8 Update Build13170 For Vsphere
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13170:*:*:*:vsphere:*:*
Matching versions
Starwindsoftware » Starwind Virtual San » Version: V8 Update Build13586 For Vsphere
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13586:*:*:*:vsphere:*:*
Matching versions
Starwindsoftware » Starwind Virtual San » Version: V8 Update Build13861 For Vsphere
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13861:*:*:*:vsphere:*:*
Matching versions

Threat overview for CVE-2020-25643

Top countries where our scanners detected CVE-2020-25643

Top open port discovered on systems with this issue 80

IPs affected by CVE-2020-25643 169,000

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-25643!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-25643

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 46 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-25643

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:M/Au:S/C:P/I:P/A:C	6.8	8.5	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Complete
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-25643

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Assigned by:
- nvd@nist.gov (Secondary)
- secalert@redhat.com (Primary)

References for CVE-2020-25643

https://bugzilla.redhat.com/show_bug.cgi?id=1879981

1879981 – (CVE-2020-25643) CVE-2020-25643 kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow
Issue Tracking;Patch;Third Party Advisory
https://www.starwindsoftware.com/security/sw-20210325-0002/

CVE-2020-25643 Linux Kernel vulnerability in StarWind VSAN for vSphere (VSA)
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00042.html

[security-announce] openSUSE-SU-2020:1698-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html

[SECURITY] [DLA 2420-2] linux regression update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html

Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2020/10/msg00028.html

[SECURITY] [DLA 2417-1] linux-4.19 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2020/dsa-4774

Debian -- Security Information -- DSA-4774-1 linux
Third Party Advisory

CVEs referencing this url
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=66d42ed8b25b64eb63111a2b8582c5afc8bf1105

kernel/git/torvalds/linux.git - Linux kernel source tree
Mailing List;Patch;Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html

[SECURITY] [DLA 2420-1] linux security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20201103-0002/

CVE-2020-25643 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory