Log in Start free

Vulnerability · Published Oct 6, 2020 · Assigned by redhat

CVE-2020-25643

High 7.2

In plain English

A high-severity improper input validation in kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.2High
Exploit odds (30 days)3.3%top 11.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8kernel-tools-libs-devel4.18.0-305.el8ALSA-2021:1578
Debian:12linux5.8.14-1DEBIAN-CVE-2020-25643
Debian:13linux5.8.14-1DEBIAN-CVE-2020-25643
Debian:14linux5.8.14-1DEBIAN-CVE-2020-25643
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2020-25643
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2020-25643
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2020-25643

Affected products (as reported)

VendorProductVersions
n/a kernel Linux kernel versions before 5.9-rc7

Weakness: CWE-20

References