CVE-2020-25643: Input Validation
A flaw was found in the HDLCPPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the pppcpparsecr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A flaw was found in the HDLCPPP module of the Linux kernel. Memory corruption and a read overflow is caused by improper input validation in the pppcpparsecr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in the Linux Kernel in the HDLCPPP module. Improper input validation in the pppcpparsecr function in hdlcppp.c leads to memory corruption and read overflow.
Reference and upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=66d42ed8b25b64eb63111a2b8582c5afc8bf1105
— Red Hat
Affected Software
Remediation
Information
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-25643?
CVE-2020-25643 has a high severity rating due to its potential to cause memory corruption and denial of service.
How do I fix CVE-2020-25643?
To fix CVE-2020-25643, update your Linux kernel to version 5.9 or later, or to the latest patched version such as 0:3.10.0-1160.11.1.el7.
Which Linux kernel versions are affected by CVE-2020-25643?
CVE-2020-25643 affects Linux kernel versions prior to 5.9-rc7, specifically versions 2.6.29 to 5.8.12.
What types of systems are impacted by CVE-2020-25643?
CVE-2020-25643 impacts various Linux distributions, including Red Hat Enterprise Linux, Debian, and openSUSE.
Can CVE-2020-25643 lead to system crashes?
Yes, CVE-2020-25643 can lead to system crashes or denial of service due to improper input validation in the HDLC_PPP module.