CVE-2020-15704: pppd arbitrary file read information disclosure vulnerability

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-01 · updated 2026-06-17
Weakness: CWE-200

Description

The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBE_OPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu1.4, 2.4.5-5.1ubuntu2.3+esm2, 2.4.7-1+2ubuntu1.16.04.3, 2.4.7-2+2ubuntu1.3, 2.4.7-2+4.1ubuntu5.1, 2.4.7-2+4.1ubuntu6. Was ZDI-CAN-11504.

Affected products

Canonical ppp: before 2.4.7-1\+ubuntu1.16.04.3; before 2.4.7-2\+2ubuntu1.3; before 2.4.7-2\+4.1ubuntu5.1; before 2.4.5-5ubuntu1.4; before 2.4.5-5.1ubuntu2.3\+esm2 — fixed in 2.4.5-5.1ubuntu2.3\+esm2, 2.4.5-5ubuntu1.4, 2.4.7-1\+ubuntu1.16.04.3, 2.4.7-2\+2ubuntu1.3, 2.4.7-2\+4.1ubuntu5.1

How to fix

Upgrade to a fixed version: Canonical ppp 2.4.5-5.1ubuntu2.3\+esm2, 2.4.5-5ubuntu1.4, 2.4.7-1\+ubuntu1.16.04.3, 2.4.7-2\+2ubuntu1.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-15704 or the next vulnerability affects your stack