CVE-2020-25670
📋 TL;DR
This CVE describes a use-after-free vulnerability in the Linux kernel's NFC LLCP (Logical Link Control Protocol) implementation. An attacker could exploit this to cause privilege escalation from a local user to root. Systems running vulnerable Linux kernel versions with NFC functionality are affected.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, allowing complete system compromise and persistence.
Likely Case
Local privilege escalation to root by a user with NFC access or ability to trigger the vulnerable code path.
If Mitigated
No impact if kernel is patched or NFC functionality is disabled/unavailable.
🎯 Exploit Status
Exploitation requires local access and ability to trigger the vulnerable llcp_sock_bind() function. Public exploit code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.10.3 and later
Vendor Advisory: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4b06b0b7ca73d5c5c6c6a
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.10.3 or later. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable NFC functionality
linuxRemove or disable NFC kernel modules to prevent exploitation
sudo modprobe -r nfc
sudo rmmod nfc
Add 'blacklist nfc' to /etc/modprobe.d/blacklist.conf
🧯 If You Can't Patch
- Restrict local user access to systems with NFC hardware
- Implement strict privilege separation and limit sudo/root access
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If version is before 5.10.3 and NFC modules are loaded, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
After patching, verify kernel version is 5.10.3 or later with uname -r and check NFC modules are not loaded with lsmod | grep nfc.📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages related to NFC or llcp_sock_bind
- Unexpected privilege escalation attempts
Network Indicators:
- Unusual NFC-related network activity if NFC over network is configured
SIEM Query:
source="kernel" AND ("NFC" OR "llcp" OR "use-after-free")🔗 References
- http://www.openwall.com/lists/oss-security/2020/11/01/1
- http://www.openwall.com/lists/oss-security/2021/05/11/4
- https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PW3OASG7OEMHANDWBM5US5WKTOC76KMH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTVACC6PGS6OSD3EYY7FZUAZT2EUMFH5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEIEGQXUW37YHZ5MTAZTDCIMHUN26NJS/
- https://security.netapp.com/advisory/ntap-20210702-0008/
- https://www.openwall.com/lists/oss-security/2020/11/01/1
- http://www.openwall.com/lists/oss-security/2020/11/01/1
- http://www.openwall.com/lists/oss-security/2021/05/11/4
- https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PW3OASG7OEMHANDWBM5US5WKTOC76KMH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTVACC6PGS6OSD3EYY7FZUAZT2EUMFH5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEIEGQXUW37YHZ5MTAZTDCIMHUN26NJS/
- https://security.netapp.com/advisory/ntap-20210702-0008/
- https://www.openwall.com/lists/oss-security/2020/11/01/1
