7.5

CVE-2020-25643

A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.29 < 4.4.238
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.238
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.200
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.148
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.68
Linux ≫ Linux Kernel Version >= 5.5 < 5.8.12
Linux ≫ Linux Kernel Version 5.9.0 Update rc1
Linux ≫ Linux Kernel Version 5.9.0 Update rc2
Linux ≫ Linux Kernel Version 5.9.0 Update rc3
Linux ≫ Linux Kernel Version 5.9.0 Update rc4
Linux ≫ Linux Kernel Version 5.9.0 Update rc5
Linux ≫ Linux Kernel Version 5.9.0 Update rc6
Redhat ≫ Enterprise Linux Version 7.0
Redhat ≫ Enterprise Linux Version 8.0
Opensuse ≫ Leap Version 15.1
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Opensuse ≫ Leap Version 15.2
Netapp ≫ H410c Firmware Version -
   Netapp ≫ H410c Version -
Starwindsoftware ≫ Starwind Virtual San Version v8 Update build12533 SwPlatform vsphere
Starwindsoftware ≫ Starwind Virtual San Version v8 Update build12658 SwPlatform vsphere
Starwindsoftware ≫ Starwind Virtual San Version v8 Update build12859 SwPlatform vsphere
Starwindsoftware ≫ Starwind Virtual San Version v8 Update build13170 SwPlatform vsphere
Starwindsoftware ≫ Starwind Virtual San Version v8 Update build13586 SwPlatform vsphere
Starwindsoftware ≫ Starwind Virtual San Version v8 Update build13861 SwPlatform vsphere
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.29% 0.87
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 6.8 8.5
AV:N/AC:M/Au:S/C:P/I:P/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2020/10/msg00028.html
Third Party Advisory
Mailing List
https://www.debian.org/security/2020/dsa-4774
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00042.html
Third Party Advisory
Mailing List
https://bugzilla.redhat.com/show_bug.cgi?id=1879981
Patch
Third Party Advisory
Issue Tracking
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=66d42ed8b25b64eb63111a2b8582c5afc8bf1105
Patch
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20201103-0002/
Third Party Advisory
https://www.starwindsoftware.com/security/sw-20210325-0002/
Third Party Advisory