CVE-2020-25643: Input Validation
A flaw was found in the HDLCPPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the pppcpparsecr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A flaw was found in the HDLCPPP module of the Linux kernel. Memory corruption and a read overflow is caused by improper input validation in the pppcpparsecr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in the Linux Kernel in the HDLCPPP module. Improper input validation in the pppcpparsecr function in hdlcppp.c leads to memory corruption and read overflow.
Reference and upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=66d42ed8b25b64eb63111a2b8582c5afc8bf1105
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.11.1.rt56.1145.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.11.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.rt7.72.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.el8 - Upgrade
Upgrade
redhat/Linux kernelto a version that resolves this vulnerability.Fixed in 5.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.9-rc7 - Configuration
Blacklist the hdlc_ppp and syncppp modules to prevent them from being loaded automatically.
Linux kernel modules module loading = blacklist hdlc_ppp and syncppp
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-25643?
CVE-2020-25643 has a high severity rating due to its potential to cause memory corruption and denial of service.
How do I fix CVE-2020-25643?
To fix CVE-2020-25643, update your Linux kernel to version 5.9 or later, or to the latest patched version such as 0:3.10.0-1160.11.1.el7.
Which Linux kernel versions are affected by CVE-2020-25643?
CVE-2020-25643 affects Linux kernel versions prior to 5.9-rc7, specifically versions 2.6.29 to 5.8.12.
What types of systems are impacted by CVE-2020-25643?
CVE-2020-25643 impacts various Linux distributions, including Red Hat Enterprise Linux, Debian, and openSUSE.
Can CVE-2020-25643 lead to system crashes?
Yes, CVE-2020-25643 can lead to system crashes or denial of service due to improper input validation in the HDLC_PPP module.