cnvd - cnvd-2020-64300

cnvd-2020-64300

Vulnerability from cnvd

Title

Linux kernel perf_event_parse_addr_filter()代码问题漏洞

Description

Linux kernel是美国Linux基金会发布的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，攻击者可利用该漏洞可以通过perf_event_parse_addr_filter()来创建内存泄漏，从而触发拒绝服务。

Severity

高

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://www.linux.org/

Reference

https://vigilance.fr/vulnerability/Linux-kernel-memory-leak-via-perf-event-parse-addr-filter-33853

Impacted products

Name
Linux Linux kernel perf_event_parse_addr_filter()

Show details on source website

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-25704",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-25704"
    }
  },
  "description": "Linux kernel\u662f\u7f8e\u56fdLinux\u57fa\u91d1\u4f1a\u53d1\u5e03\u7684\u5f00\u6e90\u64cd\u4f5c\u7cfb\u7edfLinux\u6240\u4f7f\u7528\u7684\u5185\u6838\u3002\n\nLinux kernel\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u901a\u8fc7perf_event_parse_addr_filter()\u6765\u521b\u5efa\u5185\u5b58\u6cc4\u6f0f\uff0c\u4ece\u800c\u89e6\u53d1\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://www.linux.org/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-64300",
  "openTime": "2020-11-19",
  "products": {
    "product": "Linux Linux kernel perf_event_parse_addr_filter()"
  },
  "referenceLink": "https://vigilance.fr/vulnerability/Linux-kernel-memory-leak-via-perf-event-parse-addr-filter-33853",
  "serverity": "\u9ad8",
  "submitTime": "2020-11-10",
  "title": "Linux kernel perf_event_parse_addr_filter()\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2020-25704 (GCVE-0-2020-25704)

Vulnerability from cvelistv5

Published

2020-12-02 00:00

Modified

2024-08-04 15:40

Severity ?

CWE

CWE-401

Summary

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.

References

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=1895961
	https://www.openwall.com/lists/oss-security/2020/11/09/1
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7bdb157cdebbf95a1cd94ed2e01b338714075d00
	https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html	mailing-list
	https://www.starwindsoftware.com/security/sw-20220802-0003/

Impacted products

	Vendor	Product	Version
	n/a	kernel	Version: kernel 5.10-rc3

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:36.653Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895961"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2020/11/09/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7bdb157cdebbf95a1cd94ed2e01b338714075d00"
          },
          {
            "name": "[debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html"
          },
          {
            "name": "[debian-lts-announce] 20201218 [SECURITY] [DLA 2494-1] linux security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.starwindsoftware.com/security/sw-20220802-0003/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "kernel 5.10-rc3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-11T00:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895961"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2020/11/09/1"
        },
        {
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7bdb157cdebbf95a1cd94ed2e01b338714075d00"
        },
        {
          "name": "[debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html"
        },
        {
          "name": "[debian-lts-announce] 20201218 [SECURITY] [DLA 2494-1] linux security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html"
        },
        {
          "url": "https://www.starwindsoftware.com/security/sw-20220802-0003/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-25704",
    "datePublished": "2020-12-02T00:00:00",
    "dateReserved": "2020-09-16T00:00:00",
    "dateUpdated": "2024-08-04T15:40:36.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.