CVE-2020-25645

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-10-13 · updated 2026-06-17
Weakness: CWE-319

Description

A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04
Debian Linux: 9.0, 10.0
Linux kernel: before 5.9.0; 5.9.0, 5.9.0-rc1, 5.9.0-rc2, 5.9.0-rc3, 5.9.0-rc4, 5.9.0-rc5 (+1) — fixed in 5.9.0
NetApp Hci Compute Node Bios: all versions
NetApp Solidfire & Hci Management Node: all versions
NetApp Solidfire & Hci Storage Node: all versions
openSUSE Leap: 15.1, 15.2

How to fix

Upgrade to a fixed version: Linux kernel 5.9.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-25645 or the next vulnerability affects your stack