CVE-2020-25641: Medium severity Linux Linux kernel vulnerability
A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Other sources
A flaw was found in the Linux kernel’s implementation of biovecs. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
A flaw was found in the Linux kernels implementation of biovec usage. A zero-length biovec request issued to the block subsystem could cause the kernel to enter an infinite loop causing a denial of service. An attacker with a local account can issue requests to a block device can cause a denial of service.
References:
https://bugzilla.redhat.com/showbug.cgi?id=1872032 https://lore.kernel.org/lkml/89F418A9-EB20-48CB-9AE0-52C700E6BB74@lca.pw/
Proposed Fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7e24969022cbd61ddc586f14824fc205661bb124
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.33.1.el7a - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.rt7.54.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.34.1.el8_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.40.1.rt13.90.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.40.1.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-25641?
CVE-2020-25641 is classified as a high severity vulnerability due to its potential for causing a denial of service.
How do I fix CVE-2020-25641?
To fix CVE-2020-25641, update to the kernel versions 5.9 or higher as specified in the advisory.
What versions of Linux are affected by CVE-2020-25641?
CVE-2020-25641 affects Linux kernel versions prior to 5.9-rc7.
Can CVE-2020-25641 be exploited locally?
Yes, CVE-2020-25641 can be exploited by local attackers with basic privileges.
What kind of impact does CVE-2020-25641 have on affected systems?
The impact of CVE-2020-25641 is a denial of service, leading to potential system unavailability.