CVE-2020-25221

2020-09-1000:00:00

ubuntu.com

linux kernel

privilege escalation

reference counting

struct page

vsyscall page

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

14.2%

JSON

get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7
allows privilege escalation because of incorrect reference counting (caused
by gate page mishandling) of the struct page that backs the vsyscall page.
The result is a refcount underflow. This can be triggered by any 64-bit
process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743.