What’s Vulnerable › Vulnerabilities
CVE-2020-25643
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-10-06 · updated 2026-06-17
- Weakness: CWE-20
Description
A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected products
- Debian Linux: 9.0, 10.0
- Linux kernel: from 2.6.29 before 4.4.238; from 4.5 before 4.9.238; from 4.10 before 4.14.200; from 4.15 before 4.19.148; from 4.20 before 5.4.68; from 5.5 before 5.8.12 — fixed in 4.14.200, 4.19.148, 4.4.238, 4.9.238, 5.4.68, 5.8.12
- NetApp H410C Firmware: all versions
- openSUSE Leap: 15.1, 15.2
- Red Hat Enterprise Linux: 7.0, 8.0
- Starwindsoftware Starwind Virtual San: v8-build12533, v8-build12658, v8-build12859, v8-build13170, v8-build13586, v8-build13861
How to fix
Upgrade to a fixed version: Linux kernel 4.14.200, 4.19.148, 4.4.238, 4.9.238. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00042.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1879981
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=66d42ed8b25b64eb63111a2b8582c5afc8bf1105
- https://lists.debian.org/debian-lts-announce/2020/10/msg00028.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
- https://security.netapp.com/advisory/ntap-20201103-0002/
- https://www.debian.org/security/2020/dsa-4774
- https://www.starwindsoftware.com/security/sw-20210325-0002/
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00042.html
Get alerted when CVE-2020-25643 or the next vulnerability affects your stack