Linux Kernel up to 5.7.x/5.8.6 Reference Counting mm/gup.c get_gate_page Underflow operation after expiration

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.7.x/5.8.6. It has been rated as critical. Affected is the function get_gate_page of the file mm/gup.c of the component Reference Counting. The manipulation leads to operation after expiration (Underflow). This vulnerability is referenced as CVE-2020-25221. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.7.x/5.8.6 (Operating System) and classified as critical. This issue affects the function get_gate_page of the file mm/gup.c of the component Reference Counting. The manipulation with an unknown input leads to a operation after expiration vulnerability (Underflow). Using CWE to declare the problem leads to CWE-672. The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743.

The weakness was published 09/10/2020 (oss-sec). The advisory is shared at openwall.com. The identification of this vulnerability is CVE-2020-25221 since 09/10/2020. An attack has to be approached locally. The successful exploitation requires a simple authentication. Technical details are known, but no exploit is available.

Upgrading to version 5.8.7 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8.0
• 5.8.1
• 5.8.2
• 5.8.3
• 5.8.4
• 5.8.5
• 5.8.6

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion