Linux Kernel up to 5.8.2 NFS Client fs/nfs/nfs4proc.c toctou

Summaryinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 5.8.2. The affected element is an unknown function of the file fs/nfs/nfs4proc.c of the component NFS Client. Executing a manipulation can lead to toctou. This vulnerability is tracked as CVE-2020-25212. The attack is restricted to local execution. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel up to 5.8.2 (Operating System). This vulnerability affects some unknown functionality of the file fs/nfs/nfs4proc.c of the component NFS Client. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.

The weakness was disclosed 09/09/2020. This vulnerability was named CVE-2020-25212 since 09/09/2020. Local access is required to approach this attack. A single authentication is required for exploitation. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 208554 (CentOS 7 : kernel-alt (RHSA-2020:4279)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.8.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (208554). The entry VDB-161001 is pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.8.0
• 5.8.1
• 5.8.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion