CVE-2020-25704: Medium severity Linux Linux kernel vulnerability
A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERFEVENTIOCSETFILTER. A local user could use this flaw to starve the resources causing denial of service.
Other sources
A memory leak flaw was found in the Linux kernel’s performance monitoring subsystem when using PERFEVENTIOCSETFILTER. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.
There is a memory leak in perfeventparseaddrfilter.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.53.1.rt56.1193.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.53.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.rt7.72.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.el8 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.60.2.rt13.112.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.60.2.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-25704?
CVE-2020-25704 has a CVSS score that indicates it is a medium severity vulnerability due to the potential for local denial of service.
How do I fix CVE-2020-25704?
To fix CVE-2020-25704, update to the appropriate patched versions of the Linux kernel as specified in the affected software documentation.
What systems are affected by CVE-2020-25704?
CVE-2020-25704 affects versions of the Linux kernel prior to the patched versions provided by Red Hat and Debian.
What are the implications of CVE-2020-25704?
Exploitation of CVE-2020-25704 could lead to resource starvation and cause a denial of service condition for local users on the affected systems.
Is there a workaround for CVE-2020-25704?
There are no specific workarounds for CVE-2020-25704, so applying the recommended security updates is essential.