Linux Kernel up to 5.8.7 Netlink Config nf_conntrack_netlink.c ctnetlink_parse_tuple_filter buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 5.8.7. Impacted is the function ctnetlink_parse_tuple_filter of the file net/netfilter/nf_conntrack_netlink.c of the component Netlink Config Handler. Performing a manipulation results in buffer overflow. This vulnerability is identified as CVE-2020-25211. The attack is only possible with local access. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in Linux Kernel up to 5.8.7 (Operating System). This affects the function ctnetlink_parse_tuple_filter of the file net/netfilter/nf_conntrack_netlink.c of the component Netlink Config Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.

The weakness was released 09/09/2020. This vulnerability is uniquely identified as CVE-2020-25211 since 09/09/2020. An attack has to be approached locally. The successful exploitation needs a authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/09/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entry connected to this vulnerability is available at VDB-161002. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.8.0
• 5.8.1
• 5.8.2
• 5.8.3
• 5.8.4
• 5.8.5
• 5.8.6
• 5.8.7

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion