CVE-2020-25284: Medium severity linux kernel vulnerability
A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel. Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add or remove Rados Block Devices from the system.
Other sources
The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe.
The rbd block device driver in drivers/block/rbd.c in the Linux kernel used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices.
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f44d04e696feaf13d192d942c4f14ad2e117065a
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-25284?
CVE-2020-25284 has been classified as having a high severity level due to its potential to allow unauthorized manipulation of Rados Block Devices.
How do I fix CVE-2020-25284?
To mitigate CVE-2020-25284, upgrade to the specific patched versions of the kernel packages as provided by your Linux distribution.
Who is affected by CVE-2020-25284?
Users running vulnerable versions of the Linux kernel or specific distributions like Red Hat, Debian, or openSUSE are affected by CVE-2020-25284.
What are the impacted Linux kernel versions in CVE-2020-25284?
CVE-2020-25284 affects Linux kernel versions prior to 5.8.9 as well as specific packaged versions in various distributions.
Can CVE-2020-25284 be exploited remotely?
CVE-2020-25284 requires local root privileges for exploitation, therefore it cannot be exploited remotely.