Login Sign Up

CVE-2020-25220

7.8 HIGH

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's cgroups feature due to a flawed backport of a security patch. It allows local attackers to potentially escalate privileges or cause denial of service. Systems running affected Linux kernel versions with cgroups enabled are vulnerable.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, 4.19.x before 4.19.140
Operating Systems: Linux distributions using affected kernel versions
Default Config Vulnerable: ⚠️ Yes
Notes: Requires cgroups feature to be enabled (enabled by default in most distributions).

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel panic leading to system crash, or arbitrary code execution in kernel context.

🟠

Likely Case

Local privilege escalation allowing attackers to gain root access on vulnerable systems.

🟢

If Mitigated

Limited impact if proper access controls prevent local user access or if cgroups are disabled.

🌐 Internet-Facing: LOW - This is a local vulnerability requiring access to the system.
🏢 Internal Only: HIGH - Internal attackers or compromised accounts can exploit this for privilege escalation.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Requires local access and knowledge of kernel exploitation techniques. No public exploit code identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel 4.9.233, 4.14.194, 4.19.140 and later

Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1868453

Restart Required: Yes

Instructions:

1. Update kernel to patched version via distribution package manager. 2. For Red Hat/CentOS: yum update kernel. 3. For Ubuntu/Debian: apt update && apt upgrade linux-image. 4. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable cgroups

linux

Disable the cgroups feature to prevent exploitation (not recommended for production systems).

Add 'cgroup_disable=memory' to kernel boot parameters in GRUB configuration

🧯 If You Can't Patch

  • Restrict local user access to vulnerable systems
  • Implement strict privilege separation and monitor for suspicious local activity

🔍 How to Verify

Check if Vulnerable:

Check kernel version with 'uname -r' and compare against affected versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is 4.9.233+, 4.14.194+, or 4.19.140+ after update and reboot.

📡 Detection & Monitoring

Log Indicators:

  • Kernel panic logs
  • OOM killer activity related to cgroups
  • Unexpected privilege escalation

Network Indicators:

  • None - this is a local vulnerability

SIEM Query:

Search for kernel version strings in system logs matching affected versions

📊 Metadata

CVE ID: CVE-2020-25220
CVSS v3 Score: 7.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-416
Published: September 10, 2020
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-25220, you might also want to check these:

CVE-2025-24085 10.0

This CVE describes a use-after-free vulnerability (CWE-416) in Apple operating systems that allows m...

Same vulnerability type (CWE-416)
CVE-2024-43102 10.0

This CVE describes a use-after-free vulnerability in FreeBSD's umtx (user mutex) subsystem where con...

Same vulnerability type (CWE-416)
CVE-2021-33796 10.0

CVE-2021-33796 is a use-after-free vulnerability in MuJS's regexp source property access that can le...

Same vulnerability type (CWE-416)