cnvd - cnvd-2020-52618

cnvd-2020-52618

Vulnerability from cnvd

Title: Linux kernel权限提升漏洞（CNVD-2020-52618）

Description:

Linux kernel是美国Linux基金会发布的开源操作系统Linux所使用的内核。

Linux kernel存在权限提升漏洞。该漏洞源于网络系统或产品中缺少身份验证措施或身份验证强度不足。目前没有详细的漏洞细节提供。

Severity: 高

Patch Name: Linux kernel权限提升漏洞（CNVD-2020-52618）的补丁

Patch Description:

Linux kernel是美国Linux基金会发布的开源操作系统Linux所使用的内核。

Linux kernel存在权限提升漏洞。该漏洞源于网络系统或产品中缺少身份验证措施或身份验证强度不足。目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8891adc61dce2a8a41fc0c23262b681c3ec4b73a

Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-25221

Impacted products

Name
['Linux Linux kernel 5.7.', 'Linux Linux kernel 5.8.，<5.8.7']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-25221",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-25221"
    }
  },
  "description": "Linux kernel\u662f\u7f8e\u56fdLinux\u57fa\u91d1\u4f1a\u53d1\u5e03\u7684\u5f00\u6e90\u64cd\u4f5c\u7cfb\u7edfLinux\u6240\u4f7f\u7528\u7684\u5185\u6838\u3002\n\nLinux kernel\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u4e2d\u7f3a\u5c11\u8eab\u4efd\u9a8c\u8bc1\u63aa\u65bd\u6216\u8eab\u4efd\u9a8c\u8bc1\u5f3a\u5ea6\u4e0d\u8db3\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8891adc61dce2a8a41fc0c23262b681c3ec4b73a",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-52618",
  "openTime": "2020-09-18",
  "patchDescription": "Linux kernel\u662f\u7f8e\u56fdLinux\u57fa\u91d1\u4f1a\u53d1\u5e03\u7684\u5f00\u6e90\u64cd\u4f5c\u7cfb\u7edfLinux\u6240\u4f7f\u7528\u7684\u5185\u6838\u3002\r\n\r\nLinux kernel\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u4e2d\u7f3a\u5c11\u8eab\u4efd\u9a8c\u8bc1\u63aa\u65bd\u6216\u8eab\u4efd\u9a8c\u8bc1\u5f3a\u5ea6\u4e0d\u8db3\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Linux kernel\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2020-52618\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Linux Linux kernel 5.7.*",
      "Linux Linux kernel 5.8.*\uff0c\u003c5.8.7"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-25221",
  "serverity": "\u9ad8",
  "submitTime": "2020-09-11",
  "title": "Linux kernel\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2020-52618\uff09"
}

CVE-2020-25221 (GCVE-0-2020-25221)

Vulnerability from cvelistv5

Published

2020-09-10 13:39

Modified

2024-08-04 15:33

Severity ?

CWE

Summary

get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743.

References

▼	URL	Tags
	https://www.openwall.com/lists/oss-security/2020/09/08/4	x_refsource_MISC
	https://git.kernel.org/linus/9fa2dd946743ae6f30dc4830da19147bf100a7f2	x_refsource_MISC
	https://git.kernel.org/linus/8891adc61dce2a8a41fc0c23262b681c3ec4b73a	x_refsource_MISC
	https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2020/09/10/4	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20201001-0003/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:33:04.432Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2020/09/08/4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://git.kernel.org/linus/9fa2dd946743ae6f30dc4830da19147bf100a7f2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://git.kernel.org/linus/8891adc61dce2a8a41fc0c23262b681c3ec4b73a"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7"
          },
          {
            "name": "[oss-security] 20200910 Re: CVE Request: Linux kernel vsyscall page refcounting error",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/09/10/4"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201001-0003/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-01T13:06:14",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2020/09/08/4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://git.kernel.org/linus/9fa2dd946743ae6f30dc4830da19147bf100a7f2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://git.kernel.org/linus/8891adc61dce2a8a41fc0c23262b681c3ec4b73a"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7"
        },
        {
          "name": "[oss-security] 20200910 Re: CVE Request: Linux kernel vsyscall page refcounting error",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/09/10/4"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201001-0003/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-25221",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.openwall.com/lists/oss-security/2020/09/08/4",
              "refsource": "MISC",
              "url": "https://www.openwall.com/lists/oss-security/2020/09/08/4"
            },
            {
              "name": "https://git.kernel.org/linus/9fa2dd946743ae6f30dc4830da19147bf100a7f2",
              "refsource": "MISC",
              "url": "https://git.kernel.org/linus/9fa2dd946743ae6f30dc4830da19147bf100a7f2"
            },
            {
              "name": "https://git.kernel.org/linus/8891adc61dce2a8a41fc0c23262b681c3ec4b73a",
              "refsource": "MISC",
              "url": "https://git.kernel.org/linus/8891adc61dce2a8a41fc0c23262b681c3ec4b73a"
            },
            {
              "name": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7",
              "refsource": "MISC",
              "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7"
            },
            {
              "name": "[oss-security] 20200910 Re: CVE Request: Linux kernel vsyscall page refcounting error",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/09/10/4"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201001-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201001-0003/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-25221",
    "datePublished": "2020-09-10T13:39:59",
    "dateReserved": "2020-09-10T00:00:00",
    "dateUpdated": "2024-08-04T15:33:04.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted